Critical severity · published Oct 6, 2022
CVE-2022-39237
Digital Signature Hash Algorithms Not Validated in sylabs/sif
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
sif · sylabs
< 2.8.1 · source: vendor
SI
Singularity Image Format · Sylabs
before 2.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39237
Patch
https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa
Third Party Advisory
https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
Third Party Advisory
https://security.gentoo.org/glsa/202210-19