crítica
CVE-2022-39237
syslabs/sif is the Singularity Image Format (SIF) reference implementa ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Ubuntu (media).
Descripción
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.19 | apptainer | 1.1.2-r0 |
| alpine 3.20 | apptainer | 1.1.2-r0 |
| alpine 3.21 | apptainer | 1.1.2-r0 |
| alpine 3.22 | apptainer | 1.1.2-r0 |
| alpine 3.23 | apptainer | 1.1.2-r0 |
| alpine 3.24 | apptainer | 1.1.2-r0 |
| alpine edge | apptainer | 1.1.2-r0 |
| debian 11 | golang-github-sylabs-sif | sin corrección indicada |
| debian 12 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 13 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 14 | golang-github-sylabs-sif | 2.8.3-1 |
| echo | golang-github-sylabs-sif | 2.8.3-1 |
Mostrar las 15 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.19 | apptainer | 1.1.2-r0 |
| alpine 3.20 | apptainer | 1.1.2-r0 |
| alpine 3.21 | apptainer | 1.1.2-r0 |
| alpine 3.22 | apptainer | 1.1.2-r0 |
| alpine 3.23 | apptainer | 1.1.2-r0 |
| alpine 3.24 | apptainer | 1.1.2-r0 |
| alpine edge | apptainer | 1.1.2-r0 |
| debian 11 | golang-github-sylabs-sif | sin corrección indicada |
| debian 12 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 13 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 14 | golang-github-sylabs-sif | 2.8.3-1 |
| echo | golang-github-sylabs-sif | 2.8.3-1 |
| go::GitHub Security Advisory Go | github.com/sylabs/sif/v2 | 2.8.1 |
| ubuntu 20.04-ESM | golang-github-sylabs-sif | sin corrección indicada |
| ubuntu 22.04 | golang-github-sylabs-sif | sin corrección indicada |
Referencias
- https://github.com/sylabs/sif
- https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa
- https://github.com/sylabs/sif/commit/21972852d8783bc93fbf080190de8e1978f1c254%20%28v2.8.1%29
- https://github.com/sylabs/sif/commit/a854038ce1f18237b81d505a1c3be6a60505db52%20%28v2.8.1%29
- https://github.com/sylabs/sif/releases/tag/v2.8.1
- https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
- https://nvd.nist.gov/vuln/detail/CVE-2022-39237
- https://nvd.nist.gov/vuln/detail/cve-2004-2761