← Vulnerability feed

Vulnerability record · CVE-2020-13845 · published 14 July 2020

CVE-2020-13845: Sylabs singularity improper verification of cryptographic signature vulnerability

Sylabs · Singularity

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

7.5 CVSS 3.1 High EPSS 0.52% · top 57.2% CWE-347 · Improper verification of cryptographic signatureCWE-354 · CWE-354
7.5CVSS 3.1 base score, v2 5.0
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html Broken Link
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c Third Party Advisory
https://medium.com/sylabs Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html Broken Link
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c Third Party Advisory
https://medium.com/sylabs Third Party Advisory

Track CVE-2020-13845 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-33027Sylabs singularity vulnerabilitySylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.EPSS 1.3%9.8CVE-2021-33622Sylabs singularity vulnerabilitySylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.EPSS 1.3%9.3CVE-2020-15229Sylabs singularity path traversal vulnerabilitySingularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and …EPSS 2.0%8.8CVE-2020-25040Sylabs singularity exposure of resource to wrong sphere vulnerabilitySylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a differ…EPSS 2.0%8.8CVE-2019-11328Sylabs singularity incorrect permission assignment vulnerabilityAn issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit thi…EPSS 2.1%8.1CVE-2020-25039Sylabs singularity exposure of resource to wrong sphere vulnerabilitySylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.EPSS 2.0%7.8CVE-2023-30549Lfprojects apptainer use after free vulnerabilityApptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.…EPSS 0.37%7.8CVE-2018-19295Sylabs singularity improper input validation vulnerabilitySylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2020-13845), CISA KEV, FIRST EPSS (scores of 2026-10-19). This page is refreshed as NVD updates the record.