kritik
CVE-2022-39237
syslabs/sif is the Singularity Image Format (SIF) reference implementa ...
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (orta), Ubuntu (orta).
Açıklama
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.19 | apptainer | 1.1.2-r0 |
| alpine 3.20 | apptainer | 1.1.2-r0 |
| alpine 3.21 | apptainer | 1.1.2-r0 |
| alpine 3.22 | apptainer | 1.1.2-r0 |
| alpine 3.23 | apptainer | 1.1.2-r0 |
| alpine 3.24 | apptainer | 1.1.2-r0 |
| alpine edge | apptainer | 1.1.2-r0 |
| debian 11 | golang-github-sylabs-sif | düzeltme belirtilmemiş |
| debian 12 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 13 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 14 | golang-github-sylabs-sif | 2.8.3-1 |
| echo | golang-github-sylabs-sif | 2.8.3-1 |
15 kaynaktaki 15 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.19 | apptainer | 1.1.2-r0 |
| alpine 3.20 | apptainer | 1.1.2-r0 |
| alpine 3.21 | apptainer | 1.1.2-r0 |
| alpine 3.22 | apptainer | 1.1.2-r0 |
| alpine 3.23 | apptainer | 1.1.2-r0 |
| alpine 3.24 | apptainer | 1.1.2-r0 |
| alpine edge | apptainer | 1.1.2-r0 |
| debian 11 | golang-github-sylabs-sif | düzeltme belirtilmemiş |
| debian 12 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 13 | golang-github-sylabs-sif | 2.8.3-1 |
| debian 14 | golang-github-sylabs-sif | 2.8.3-1 |
| echo | golang-github-sylabs-sif | 2.8.3-1 |
| go::GitHub Security Advisory Go | github.com/sylabs/sif/v2 | 2.8.1 |
| ubuntu 20.04-ESM | golang-github-sylabs-sif | düzeltme belirtilmemiş |
| ubuntu 22.04 | golang-github-sylabs-sif | düzeltme belirtilmemiş |
Referanslar
- https://github.com/sylabs/sif
- https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa
- https://github.com/sylabs/sif/commit/21972852d8783bc93fbf080190de8e1978f1c254%20%28v2.8.1%29
- https://github.com/sylabs/sif/commit/a854038ce1f18237b81d505a1c3be6a60505db52%20%28v2.8.1%29
- https://github.com/sylabs/sif/releases/tag/v2.8.1
- https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
- https://nvd.nist.gov/vuln/detail/CVE-2022-39237
- https://nvd.nist.gov/vuln/detail/cve-2004-2761