critique
CVE-2022-39237
syslabs/sif is the Singularity Image Format (SIF) reference implementa ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (moyenne), Ubuntu (moyenne).
Description
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.19 | apptainer | 1.1.2-r0 |
| alpine 3.20 | apptainer | 1.1.2-r0 |
| alpine 3.21 | apptainer | 1.1.2-r0 |
| alpine 3.22 | apptainer | 1.1.2-r0 |
| alpine 3.23 | apptainer | 1.1.2-r0 |
| alpine 3.24 | apptainer | 1.1.2-r0 |
| alpine edge | apptainer | 1.1.2-r0 |
| debian 11 | golang-github-sylabs-sif | pas de correctif indiqué |
| debian 12 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 13 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 14 | golang-github-sylabs-sif | 2.8.3-1 |
| echo | golang-github-sylabs-sif | 2.8.3-1 |
Afficher les 15 entrées de 15 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.19 | apptainer | 1.1.2-r0 |
| alpine 3.20 | apptainer | 1.1.2-r0 |
| alpine 3.21 | apptainer | 1.1.2-r0 |
| alpine 3.22 | apptainer | 1.1.2-r0 |
| alpine 3.23 | apptainer | 1.1.2-r0 |
| alpine 3.24 | apptainer | 1.1.2-r0 |
| alpine edge | apptainer | 1.1.2-r0 |
| debian 11 | golang-github-sylabs-sif | pas de correctif indiqué |
| debian 12 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 13 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 14 | golang-github-sylabs-sif | 2.8.3-1 |
| echo | golang-github-sylabs-sif | 2.8.3-1 |
| go::GitHub Security Advisory Go | github.com/sylabs/sif/v2 | 2.8.1 |
| ubuntu 20.04-ESM | golang-github-sylabs-sif | pas de correctif indiqué |
| ubuntu 22.04 | golang-github-sylabs-sif | pas de correctif indiqué |
Références
- https://github.com/sylabs/sif
- https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa
- https://github.com/sylabs/sif/commit/21972852d8783bc93fbf080190de8e1978f1c254%20%28v2.8.1%29
- https://github.com/sylabs/sif/commit/a854038ce1f18237b81d505a1c3be6a60505db52%20%28v2.8.1%29
- https://github.com/sylabs/sif/releases/tag/v2.8.1
- https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
- https://nvd.nist.gov/vuln/detail/CVE-2022-39237
- https://nvd.nist.gov/vuln/detail/cve-2004-2761