CVE-2019-19724 - Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services

Back Back to CVE browser

HIGH

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services

Published Dec 18, 2019

7.5

HIGH

CVSS 3.1

EPSS 1.23%

Description

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

Affected products

Ecosystem	Package	Introduced	Fixed
Go	github.com/sylabs/singularity	3.3.0	3.5.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (7)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
vendor-advisoryx_refsource_SUSE
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4576
Advisory
https://github.com/advisories/GHSA-mj73-5x75-9phh
Advisory
https://github.com/sylabs/singularity/commit/2cda4981812c29f0fb11d3ea6aaf6139f665a631
https://github.com/sylabs/singularity/releases/tag/v3.5.2
x_refsource_CONFIRMRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-19724

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html		vendor-advisoryx_refsource_SUSE
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4576		Advisory
https://github.com/advisories/GHSA-mj73-5x75-9phh		Advisory
https://github.com/sylabs/singularity/commit/2cda4981812c29f0fb11d3ea6aaf6139f665a631
https://github.com/sylabs/singularity/releases/tag/v3.5.2		x_refsource_CONFIRMRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-19724