Homepage

Incorrect Permission Assignment for Critical Resource The advisory has been revoked - it doesn't affect any version of package singularity-container  (opens in a new tab)

Threat Intelligence

EPSS
2.09% (81st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-SINGULARITYCONTAINER-346511
  • published14 May 2019
  • disclosed14 May 2019
Report a new vulnerability Found a mistake?

Introduced: 14 May 2019

CVE-2019-11328  (opens in a new tab)
CWE-732  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:unstable.

NVD Description

Note: Versions mentioned in the description apply only to the upstream singularity-container package and not the singularity-container package as distributed by Debian.

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within /run/singularity/instances/sing/<user>/<instance>. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.

References