CVE-2020-13845

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347 CWE-354

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.htmlBroken Link
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5cThird Party Advisory
https://medium.com/sylabsThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.htmlBroken Link
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5cThird Party Advisory
https://medium.com/sylabsThird Party Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-138467.5Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.CVE-2020-138477.5Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found i CVE-2020-138487.5Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message d CVE-2020-138497.5The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remot CVE-2020-13857.8An elevation of privilege vulnerability exists in the way that the Windows Credential Picker handles objects in memory, aka 'Windows Credent CVE-2020-138507.5Artica Pandora FMS 7.44 has inadequate access controls on a web folder.CVE-2020-138518.8Artica Pandora FMS 7.44 allows remote command execution via the events feature.CVE-2020-138527.2Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.CVE-2020-138535.4Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.CVE-2020-138549.8Artica Pandora FMS 7.44 allows privilege escalation.CVE-2020-138557.2Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.CVE-2020-138567.5An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that