Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 792465 (CVE-2021-32635) - <sys-cluster/singularity-3.7.4: action commands against library URIs ignore configured remote endpoint
Summary: <sys-cluster/singularity-3.7.4: action commands against library URIs ignore c...
Status: RESOLVED FIXED
Alias: CVE-2021-32635
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major
Assignee: Gentoo Security
URL: https://github.com/hpcng/singularity/...
Whiteboard: B1 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-27 10:45 UTC by Marek Szuba (RETIRED)
Modified: 2021-07-22 04:55 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marek Szuba (RETIRED) archtester gentoo-dev 2021-05-27 10:45:03 UTC 
In singularity 3.7.2 and 3.7.3, action commands against library:// URIs erroneously always used the default remote endpoint (cloud.sylabs.io). An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-28 00:28:25 UTC 
x86 done
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-28 00:28:30 UTC 
amd64 done

all arches done
Comment 3 Larry the Git Cow gentoo-dev 2021-05-28 08:42:52 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=086e1d23d289498f83d7d321dc39ff1caaa79b9f

commit 086e1d23d289498f83d7d321dc39ff1caaa79b9f
Author:     Marek Szuba <marecki@gentoo.org>
AuthorDate: 2021-05-28 08:41:32 +0000
Commit:     Marek Szuba <marecki@gentoo.org>
CommitDate: 2021-05-28 08:42:03 +0000

    sys-cluster/singularity: drop 3.7.3
    
    No versions vulnerable to CVE-2021-32635 left in the tree.
    
    Bug: https://bugs.gentoo.org/792465
    Signed-off-by: Marek Szuba <marecki@gentoo.org>

 sys-cluster/singularity/Manifest                 |  1 -
 sys-cluster/singularity/singularity-3.7.3.ebuild | 73 ------------------------
 2 files changed, 74 deletions(-)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-05-30 16:07:10 UTC 
Thank you for the report!
Comment 5 NATTkA bot gentoo-dev 2021-07-17 21:20:26 UTC 
Unable to check for sanity:

> no match for package: =sys-cluster/singularity-3.7.4
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-07-19 02:57:17 UTC 
GLSA request filed.
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2021-07-22 04:55:25 UTC 
This issue was resolved and addressed in
 GLSA 202107-50 at https://security.gentoo.org/glsa/202107-50
by GLSA coordinator John Helmert III (ajak).