CVE-2020-25039: Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution

High severity · published Sep 16, 2020

CVE-2020-25039

Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution

8.1

CVSS

EPSS

On KEV

Description

Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.0% · higher than 81% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Leap · Opensuse

15.1; 15.2 · source: NVD

Singularity · Sylabs

3.2.0 through 3.6.2 · source: NVD

Affected product

Leap

Opensuse

All Leap CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-25039

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-25039

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00070.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00088.html

Mitigation

https://github.com/hpcng/singularity/security/advisories/GHSA-w6v2-qchm-grj7

Product

https://medium.com/sylabs