Vulnerability-Lookup

CVE-2022-39237 (GCVE-0-2022-39237)

Vulnerability from cvelistv5 – Published: 2022-10-06 00:00 – Updated: 2025-04-23 16:53

Title

Digital Signature Hash Algorithms Not Validated in sylabs/sif

Summary

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:56 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/sylabs/sif/security/advisories…
https://github.com/sylabs/sif/commit/07fb86029a12…
https://security.gentoo.org/glsa/202210-19	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
sylabs	sif	Affected: < 2.8.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:00:43.155Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
          },
          {
            "name": "GLSA-202210-19",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:56:51.919225Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:53:04.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sif",
          "vendor": "sylabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-31T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
        },
        {
          "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
        },
        {
          "name": "GLSA-202210-19",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-19"
        }
      ],
      "source": {
        "advisory": "GHSA-m5m3-46gj-wch8",
        "discovery": "UNKNOWN"
      },
      "title": "Digital Signature Hash Algorithms Not Validated in sylabs/sif"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39237",
    "datePublished": "2022-10-06T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:53:04.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-39237",
      "date": "2026-09-16",
      "epss": "0.00533",
      "percentile": "0.43667"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sylabs:singularity_image_format:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.8.1\", \"matchCriteriaId\": \"55B4B89E-C630-4A9C-9AE5-8EB9FBCC5336\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.\"}, {\"lang\": \"es\", \"value\": \"syslabs/sif es la implementaci\\u00f3n de referencia del Formato de Imagen de Singularidad (SIF). En las versiones anteriores a 2.8.1, el paquete \\\"github.com/sylabs/sif/v2/pkg/integrity\\\" no verificaba que los algoritmos hash usados fueran criptogr\\u00e1ficamente seguros cuando eran verificadas las firmas digitales. Se presenta un parche disponible en versiones posteriores a v2.8.1 incluy\\u00e9ndola, del m\\u00f3dulo. Es recomendado a usuarios actualizar. Los usuarios que no puedan actualizarse pueden comprobar de forma independiente que los algoritmos de hash usados para el resumen de metadatos y el hash de la firma son criptogr\\u00e1ficamente seguros\"}]",
      "id": "CVE-2022-39237",
      "lastModified": "2024-11-21T07:17:50.937",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2022-10-06T18:16:10.160",
      "references": "[{\"url\": \"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202210-19\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202210-19\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-347\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-327\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-39237\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-10-06T18:16:10.160\",\"lastModified\":\"2026-06-17T04:57:58.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.\"},{\"lang\":\"es\",\"value\":\"syslabs/sif es la implementaci\u00f3n de referencia del Formato de Imagen de Singularidad (SIF). En las versiones anteriores a 2.8.1, el paquete \\\"github.com/sylabs/sif/v2/pkg/integrity\\\" no verificaba que los algoritmos hash usados fueran criptogr\u00e1ficamente seguros cuando eran verificadas las firmas digitales. Se presenta un parche disponible en versiones posteriores a v2.8.1 incluy\u00e9ndola, del m\u00f3dulo. Es recomendado a usuarios actualizar. Los usuarios que no puedan actualizarse pueden comprobar de forma independiente que los algoritmos de hash usados para el resumen de metadatos y el hash de la firma son criptogr\u00e1ficamente seguros\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"sylabs\",\"product\":\"sif\",\"versions\":[{\"version\":\"\u003c 2.8.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-04-23T13:56:51.919225Z\",\"id\":\"CVE-2022-39237\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sylabs:singularity_image_format:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.8.1\",\"matchCriteriaId\":\"55B4B89E-C630-4A9C-9AE5-8EB9FBCC5336\"}]}]}],\"references\":[{\"url\":\"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202210-19\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202210-19\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T01:07:58+00:00",
      "cve": "CVE-2022-39237",
      "id": "CVE-2022-39237",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Digital Signature Hash Algorithms Not Validated in sylabs/sif",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-39237.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-10T03:27:44Z",
      "cve": "CVE-2022-39237",
      "id": "CVE-2022-39237",
      "initial_release_date": "2023-02-15T03:23:53Z",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-39237",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-39237.json",
      "version": "9"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202210-19\", \"name\": \"GLSA-202210-19\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T12:00:43.155Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-39237\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T13:56:51.919225Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T13:56:53.174Z\"}}], \"cna\": {\"title\": \"Digital Signature Hash Algorithms Not Validated in sylabs/sif\", \"source\": {\"advisory\": \"GHSA-m5m3-46gj-wch8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"sylabs\", \"product\": \"sif\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.8.1\"}]}], \"references\": [{\"url\": \"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8\"}, {\"url\": \"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\"}, {\"url\": \"https://security.gentoo.org/glsa/202210-19\", \"name\": \"GLSA-202210-19\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"CWE-347: Improper Verification of Cryptographic Signature\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-10-31T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-39237\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T16:53:04.342Z\", \"dateReserved\": \"2022-09-02T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-10-06T00:00:00.000Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2022-87947

Vulnerability from cnvd - Published: 2022-12-15

Title

Singularity Image Format加密问题漏洞

Description

Singularity Image Format是Singularity的一个压缩的squashfs文件系统，它具有块的组织结构，包括元数据和用于容器的定义文件，首标，分区的内容，签名（如果存在的话），以及当然，二进制文件本身的容器。Singular是德国Singular开源的一个用于多项式计算的计算机代数系统。 Singularity Image Format 2.8.1之前的版本存在加密问题漏洞，该漏洞源于其位于“github.com/sylabs/sif/v2/pkg/integrity”包在验证数字签名时，不验证使用的哈希算法是安全的。攻击者可利用漏洞绕过数字签名。

Severity

高

Patch Name

Singularity Image Format加密问题漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8

Reference

https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8

Impacted products

Name
Singularity Singularity Image Format <2.8.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-39237",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-39237"
    }
  },
  "description": "Singularity Image Format\u662fSingularity\u7684\u4e00\u4e2a\u538b\u7f29\u7684squashfs\u6587\u4ef6\u7cfb\u7edf\uff0c\u5b83\u5177\u6709\u5757\u7684\u7ec4\u7ec7\u7ed3\u6784\uff0c\u5305\u62ec\u5143\u6570\u636e\u548c\u7528\u4e8e\u5bb9\u5668\u7684\u5b9a\u4e49\u6587\u4ef6\uff0c\u9996\u6807\uff0c\u5206\u533a\u7684\u5185\u5bb9\uff0c\u7b7e\u540d\uff08\u5982\u679c\u5b58\u5728\u7684\u8bdd\uff09\uff0c\u4ee5\u53ca\u5f53\u7136\uff0c\u4e8c\u8fdb\u5236\u6587\u4ef6\u672c\u8eab\u7684\u5bb9\u5668\u3002Singular\u662f\u5fb7\u56fdSingular\u5f00\u6e90\u7684\u4e00\u4e2a\u7528\u4e8e\u591a\u9879\u5f0f\u8ba1\u7b97\u7684\u8ba1\u7b97\u673a\u4ee3\u6570\u7cfb\u7edf\u3002\n\nSingularity Image Format 2.8.1\u4e4b\u524d\u7684\u7248\u672c\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5176\u4f4d\u4e8e\u201cgithub.com/sylabs/sif/v2/pkg/integrity\u201d\u5305\u5728\u9a8c\u8bc1\u6570\u5b57\u7b7e\u540d\u65f6\uff0c\u4e0d\u9a8c\u8bc1\u4f7f\u7528\u7684\u54c8\u5e0c\u7b97\u6cd5\u662f\u5b89\u5168\u7684\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u7ed5\u8fc7\u6570\u5b57\u7b7e\u540d\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-87947",
  "openTime": "2022-12-15",
  "patchDescription": "Singularity Image Format\u662fSingularity\u7684\u4e00\u4e2a\u538b\u7f29\u7684squashfs\u6587\u4ef6\u7cfb\u7edf\uff0c\u5b83\u5177\u6709\u5757\u7684\u7ec4\u7ec7\u7ed3\u6784\uff0c\u5305\u62ec\u5143\u6570\u636e\u548c\u7528\u4e8e\u5bb9\u5668\u7684\u5b9a\u4e49\u6587\u4ef6\uff0c\u9996\u6807\uff0c\u5206\u533a\u7684\u5185\u5bb9\uff0c\u7b7e\u540d\uff08\u5982\u679c\u5b58\u5728\u7684\u8bdd\uff09\uff0c\u4ee5\u53ca\u5f53\u7136\uff0c\u4e8c\u8fdb\u5236\u6587\u4ef6\u672c\u8eab\u7684\u5bb9\u5668\u3002Singular\u662f\u5fb7\u56fdSingular\u5f00\u6e90\u7684\u4e00\u4e2a\u7528\u4e8e\u591a\u9879\u5f0f\u8ba1\u7b97\u7684\u8ba1\u7b97\u673a\u4ee3\u6570\u7cfb\u7edf\u3002\r\n\r\nSingularity Image Format 2.8.1\u4e4b\u524d\u7684\u7248\u672c\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5176\u4f4d\u4e8e\u201cgithub.com/sylabs/sif/v2/pkg/integrity\u201d\u5305\u5728\u9a8c\u8bc1\u6570\u5b57\u7b7e\u540d\u65f6\uff0c\u4e0d\u9a8c\u8bc1\u4f7f\u7528\u7684\u54c8\u5e0c\u7b97\u6cd5\u662f\u5b89\u5168\u7684\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u7ed5\u8fc7\u6570\u5b57\u7b7e\u540d\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Singularity Image Format\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Singularity Singularity Image Format \u003c2.8.1"
  },
  "referenceLink": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8",
  "serverity": "\u9ad8",
  "submitTime": "2022-10-10",
  "title": "Singularity Image Format\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2022-39237

Vulnerability from fkie_nvd - Published: 2022-10-06 18:16 - Updated: 2026-06-17 04:57

Severity

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8	Third Party Advisory
security-advisories@github.com	https://security.gentoo.org/glsa/202210-19	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/202210-19	Third Party Advisory

Impacted products

	Vendor	Product	Version
	sylabs	singularity_image_format	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sif",
          "vendor": "sylabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sylabs:singularity_image_format:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "55B4B89E-C630-4A9C-9AE5-8EB9FBCC5336",
              "versionEndExcluding": "2.8.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure."
    },
    {
      "lang": "es",
      "value": "syslabs/sif es la implementaci\u00f3n de referencia del Formato de Imagen de Singularidad (SIF). En las versiones anteriores a 2.8.1, el paquete \"github.com/sylabs/sif/v2/pkg/integrity\" no verificaba que los algoritmos hash usados fueran criptogr\u00e1ficamente seguros cuando eran verificadas las firmas digitales. Se presenta un parche disponible en versiones posteriores a v2.8.1 incluy\u00e9ndola, del m\u00f3dulo. Es recomendado a usuarios actualizar. Los usuarios que no puedan actualizarse pueden comprobar de forma independiente que los algoritmos de hash usados para el resumen de metadatos y el hash de la firma son criptogr\u00e1ficamente seguros"
    }
  ],
  "id": "CVE-2022-39237",
  "lastModified": "2026-06-17T04:57:58.343",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39237",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-23T13:56:51.919225Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-10-06T18:16:10.160",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202210-19"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202210-19"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-M5M3-46GJ-WCH8

Vulnerability from github – Published: 2022-10-06 19:54 – Updated: 2023-01-10 16:09

Summary

SIF's Digital Signature Hash Algorithms Not Validated

Details

Impact

The github.com/sylabs/sif/v2/pkg/integrity package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures.

Patches

A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade.

The patch is commit https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa

Workarounds

Users may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in github.com/sylabs/sif
Email us at security@sylabs.io

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sylabs/sif/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39237"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-327",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-06T19:54:55Z",
    "nvd_published_at": "2022-10-06T18:16:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe `github.com/sylabs/sif/v2/pkg/integrity` package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures.\n\n### Patches\n\nA patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade.\n\nThe patch is commit https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa\n\n### Workarounds\n\nUsers may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.\n\n### References\n\n* [CVE-2004-2761](https://nvd.nist.gov/vuln/detail/cve-2004-2761)\n* [CVE-2005-4900](https://nvd.nist.gov/vuln/detail/cve-2005-4900)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [github.com/sylabs/sif](https://github.com/sylabs/sif/issues/new)\n* Email us at [security@sylabs.io](mailto:security@sylabs.io)",
  "id": "GHSA-m5m3-46gj-wch8",
  "modified": "2023-01-10T16:09:12Z",
  "published": "2022-10-06T19:54:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39237"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sylabs/sif"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sylabs/sif/releases/tag/v2.8.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/cve-2004-2761"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/cve-2005-4900"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-1045"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202210-19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SIF\u0027s Digital Signature Hash Algorithms Not Validated"
}

GSD-2022-39237

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-39237

Aliases

CVE-2022-39237

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-39237",
    "description": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.",
    "id": "GSD-2022-39237",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-39237.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-39237"
      ],
      "details": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.",
      "id": "GSD-2022-39237",
      "modified": "2023-12-13T01:19:20.662373Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-39237",
        "STATE": "PUBLIC",
        "TITLE": "Digital Signature Hash Algorithms Not Validated in sylabs/sif"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "sif",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 2.8.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "sylabs"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-347: Improper Verification of Cryptographic Signature"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8",
            "refsource": "CONFIRM",
            "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
          },
          {
            "name": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa",
            "refsource": "MISC",
            "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
          },
          {
            "name": "GLSA-202210-19",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202210-19"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-m5m3-46gj-wch8",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv2.8.1",
          "affected_versions": "All versions before 2.8.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-327",
            "CWE-937"
          ],
          "date": "2023-07-14",
          "description": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.",
          "fixed_versions": [
            "v2.8.1"
          ],
          "identifier": "CVE-2022-39237",
          "identifiers": [
            "CVE-2022-39237",
            "GHSA-m5m3-46gj-wch8"
          ],
          "not_impacted": "",
          "package_slug": "go/github.com/sylabs/sif",
          "pubdate": "2022-10-06",
          "solution": "Upgrade to version 2.8.1 or above.",
          "title": "Use of a Broken or Risky Cryptographic Algorithm",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-39237",
            "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8",
            "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
          ],
          "uuid": "2a790b1c-e0e5-4f19-b1f5-7c4aee6c8691",
          "versions": [
            {
              "commit": {
                "sha": "7eb02f320d582fd0c80e1048eee5bbde30e92e5c",
                "tags": [
                  "v2.8.1"
                ],
                "timestamp": "20221006115214"
              },
              "number": "v2.8.1"
            }
          ]
        },
        {
          "affected_range": "\u003cv2.8.1",
          "affected_versions": "All versions before 2.8.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-327",
            "CWE-937"
          ],
          "date": "2022-10-07",
          "description": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.",
          "fixed_versions": [
            "v2.8.1"
          ],
          "identifier": "CVE-2022-39237",
          "identifiers": [
            "GHSA-m5m3-46gj-wch8",
            "CVE-2022-39237"
          ],
          "not_impacted": "All versions starting from 2.8.1",
          "package_slug": "go/github.com/sylabs/sif/v2",
          "pubdate": "2022-10-06",
          "solution": "Upgrade to version 2.8.1 or above.",
          "title": "Use of a Broken or Risky Cryptographic Algorithm",
          "urls": [
            "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-39237",
            "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa",
            "https://github.com/sylabs/sif/releases/tag/v2.8.1",
            "https://nvd.nist.gov/vuln/detail/cve-2004-2761",
            "https://nvd.nist.gov/vuln/detail/cve-2005-4900",
            "https://github.com/advisories/GHSA-m5m3-46gj-wch8"
          ],
          "uuid": "0b7f5d89-242e-4dc9-9cfc-92da8d2310bd",
          "versions": [
            {
              "commit": {
                "sha": "7eb02f320d582fd0c80e1048eee5bbde30e92e5c",
                "tags": [
                  "v2.8.1"
                ],
                "timestamp": "20221006115214"
              },
              "number": "v2.8.1"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sylabs:singularity_image_format:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.8.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-39237"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-327"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
            },
            {
              "name": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
            },
            {
              "name": "GLSA-202210-19",
              "refsource": "GENTOO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/202210-19"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-07-14T17:24Z",
      "publishedDate": "2022-10-06T18:16Z"
    }
  }
}

OPENSUSE-SU-2023:0018-1

Vulnerability from csaf_opensuse - Published: 2023-01-15 17:01 - Updated: 2023-01-15 17:01

Summary

Security update for apptainer

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2022-39237.

CVE-2022-39237

6.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2024:12389-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

apptainer-1.1.2-1.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2022-39237.

CVE-2022-39237

6.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2024:14059-1

Vulnerability from csaf_opensuse - Published: 2024-06-20 00:00 - Updated: 2024-06-20 00:00

Summary

singularity-ce-4.1.3-1.1 on GA media

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2022-39237.

CVE-2022-39237

6.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Recommended: 4 products

Open the full advisory

ubuntu-cve-2022-39237

Vulnerability from osv_ubuntu

Published

2022-10-06 18:16

Modified

2026-05-20 14:56

Summary

Details

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

Severity

6.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-39237	REPORT
	https://github.com/sylabs/sif/security/advisories…	REPORT
	https://github.com/sylabs/sif/commit/21972852d878…	REPORT
	https://github.com/sylabs/sif/commit/a854038ce1f1…	REPORT
	https://github.com/sylabs/sif/commit/07fb86029a12…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-39237	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "singularity-container",
            "binary_version": "2.4.2-4ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "singularity-container",
        "purl": "pkg:deb/ubuntu/singularity-container@2.4.2-4ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.1-2",
        "2.3.2-1",
        "2.4.1-1",
        "2.4.2-2",
        "2.4.2-3",
        "2.4.2-4",
        "2.4.2-4ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-sylabs-sif-dev",
            "binary_version": "1.0.9-1"
          },
          {
            "binary_name": "siftool",
            "binary_version": "1.0.9-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "golang-github-sylabs-sif",
        "purl": "pkg:deb/ubuntu/golang-github-sylabs-sif@1.0.9-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.9-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-sylabs-sif-dev",
            "binary_version": "1.0.9-2.1ubuntu0.1"
          },
          {
            "binary_name": "siftool",
            "binary_version": "1.0.9-2.1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "golang-github-sylabs-sif",
        "purl": "pkg:deb/ubuntu/golang-github-sylabs-sif@1.0.9-2.1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.9-2.1",
        "1.0.9-2.1build1",
        "1.0.9-2.1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-sylabs-singularity-dev",
            "binary_version": "4.1.1+ds2-1ubuntu0.3+esm2"
          },
          {
            "binary_name": "singularity-container",
            "binary_version": "4.1.1+ds2-1ubuntu0.3+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "singularity-container",
        "purl": "pkg:deb/ubuntu/singularity-container@4.1.1+ds2-1ubuntu0.3+esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.1+ds2-1",
        "4.1.1+ds2-1build1",
        "4.1.1+ds2-1ubuntu0.1",
        "4.1.1+ds2-1ubuntu0.2",
        "4.1.1+ds2-1ubuntu0.2+esm1",
        "4.1.1+ds2-1ubuntu0.3",
        "4.1.1+ds2-1ubuntu0.3+esm1",
        "4.1.1+ds2-1ubuntu0.3+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-sylabs-singularity-dev",
            "binary_version": "4.1.5+ds4-1"
          },
          {
            "binary_name": "singularity-container",
            "binary_version": "4.1.5+ds4-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "singularity-container",
        "purl": "pkg:deb/ubuntu/singularity-container@4.1.5+ds4-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.5+ds4-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-sylabs-singularity-dev",
            "binary_version": "4.1.5+ds4-1"
          },
          {
            "binary_name": "singularity-container",
            "binary_version": "4.1.5+ds4-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "singularity-container",
        "purl": "pkg:deb/ubuntu/singularity-container@4.1.5+ds4-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.5+ds4-1"
      ]
    }
  ],
  "aliases": [],
  "details": "syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version \u003e= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.",
  "id": "UBUNTU-CVE-2022-39237",
  "modified": "2026-05-20T14:56:09Z",
  "published": "2022-10-06T18:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-39237"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/sylabs/sif/commit/21972852d8783bc93fbf080190de8e1978f1c254"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/sylabs/sif/commit/a854038ce1f18237b81d505a1c3be6a60505db52"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39237"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-39237"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-39237 (GCVE-0-2022-39237)

Impact

Patches

Workarounds

References

For more information

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour