CVE-2022-39237

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347 CWE-327

Affected software

Vendor	Product	Versions
sylabs	sif	< 2.8.1

References

https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaaPatch, Third Party Advisory
https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8Third Party Advisory
https://security.gentoo.org/glsa/202210-19Third Party Advisory
https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaaPatch, Third Party Advisory
https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8Third Party Advisory
https://security.gentoo.org/glsa/202210-19Third Party Advisory

Timeline

Published: Oct 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392388.8Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentic CVE-2022-392395.4netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image do CVE-2022-39247.5This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, confi CVE-2022-392405.4MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Exec CVE-2022-392414.9Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local ho CVE-2022-392425.3Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight w CVE-2022-392439.8NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the J CVE-2022-392449.8PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA CVE-2022-392457.8Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` CVE-2022-392465.3matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct CVE-2022-392487.5matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct CVE-2022-392497.5Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious home