Insecure Defaults Affecting package, versions <3.7.4

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    16 Jun 2021

  • disclosed

    16 Jun 2021

  • credit


How to fix?

Upgrade to version 3.7.4 or higher.


Affected versions of this package are vulnerable to Insecure Defaults. An action command singularity run/shell/exec against a container specified via a library:// URI can be configured to retrieve the container from a custom library service via the singularity remote command. If the custom remote endpoint is unavailable, or does not return a correct response, the action command will incorrectly fall back to use the default endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint. If the user's configured custom remote is inaccessible, either by co-incidence or through malicious action, a user may execute the malicious container.

This advisory differs from CVE-2021-32635 as incorrect use of the default remote is restricted to the case when the custom remote is unavailable.

Users who only interact with the default remote endpoint are not affected.