Insecure Defaults Affecting github.com/hpcng/singularity/e2e/actions package, versions <3.7.4


0.0
medium
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-GOLANG-GITHUBCOMHPCNGSINGULARITYE2EACTIONS-1309668

  • published

    16 Jun 2021

  • disclosed

    16 Jun 2021

  • credit

    Unknown

How to fix?

Upgrade github.com/hpcng/singularity/e2e/actions to version 3.7.4 or higher.

Overview

Affected versions of this package are vulnerable to Insecure Defaults. An action command singularity run/shell/exec against a container specified via a library:// URI can be configured to retrieve the container from a custom library service via the singularity remote command. If the custom remote endpoint is unavailable, or does not return a correct response, the action command will incorrectly fall back to use the default cloud.sylabs.io endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint. If the user's configured custom remote is inaccessible, either by co-incidence or through malicious action, a user may execute the malicious container.

This advisory differs from CVE-2021-32635 as incorrect use of the default remote is restricted to the case when the custom remote is unavailable.

Users who only interact with the default remote endpoint are not affected.

References