Insecure Defaults Affecting github.com/hpcng/singularity/e2e/actions Open this link in a new tab package, versions <3.7.4
Do your applications use this vulnerable package?
16 Jun 2021
16 Jun 2021
How to fix?
github.com/hpcng/singularity/e2e/actions to version 3.7.4 or higher.
Affected versions of this package are vulnerable to Insecure Defaults. An action command singularity
run/shell/exec against a container specified via a
library:// URI can be configured to retrieve the container from a custom library service via the singularity remote command. If the custom remote endpoint is unavailable, or does not return a correct response, the action command will incorrectly fall back to use the default cloud.sylabs.io endpoint.
An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint. If the user's configured custom remote is inaccessible, either by co-incidence or through malicious action, a user may execute the malicious container.
This advisory differs from CVE-2021-32635 as incorrect use of the default remote is restricted to the case when the custom remote is unavailable.
Users who only interact with the default remote endpoint are not affected.