GHSA-mj73-5x75-9phh

Source

https://github.com/advisories/GHSA-mj73-5x75-9phh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mj73-5x75-9phh/GHSA-mj73-5x75-9phh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mj73-5x75-9phh

Aliases

CVE-2019-19724

Published

2022-05-24T17:04:02Z

Modified

2023-11-08T04:01:29.285393Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Singularity insecure permissions

Details

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

Database specific

{
    "nvd_published_at": "2019-12-18T21:15:00Z",
    "cwe_ids": [
        "CWE-276"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-18T21:02:11Z"
}

References

Affected packages

Go / github.com/sylabs/singularity

Package

Name: github.com/sylabs/singularity; View open source insights on deps.dev
Purl: pkg:golang/github.com/sylabs/singularity

Affected ranges

Type: SEMVER
Events: Introduced

3.3.0

Fixed

3.5.2

Database specific

{
    "last_known_affected_version_range": "<= 3.5.1"
}