{"id":"CVE-2020-13846","aliases":["ALPINE-CVE-2020-13846","EUVD-2021-2463","GHSA-6w7g-p4jh-rf92","UBUNTU-CVE-2020-13846","openSUSE-SU-2020:1011-1","openSUSE-SU-2020:1037-1","openSUSE-SU-2020:1100-1","openSUSE-SU-2024:11384-1"],"status":"published","title":"\"Verify All\" Returns Success Despite Validation Failures in Singularity","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01336,"percentile":0.71457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-07-14T17:30:09Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Go","package":"github.com/sylabs/singularity","fixed_in":["3.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.19","package":"singularity","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"singularity","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"singularity","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"singularity","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"singularity","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"singularity","fixed_in":["3.6.0-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/sylabs/singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sylabs/singularity","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0"},{"fixed":"3.6.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-2","2.3.2-1","2.4.1-1","2.4.2-2","2.4.2-3","2.4.2-4","2.4.2-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+ds2-1","4.1.1+ds2-1build1","4.1.1+ds2-1ubuntu0.1","4.1.1+ds2-1ubuntu0.2","4.1.1+ds2-1ubuntu0.2+esm1","4.1.1+ds2-1ubuntu0.3","4.1.1+ds2-1ubuntu0.3+esm1","4.1.1+ds2-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.5+ds4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.5+ds4-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-lp151.2.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-bp152.2.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"singularity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1.2"}]}],"bundled":12}],"products":[{"vendor":"sylabs","product":"singularity"}],"references":[{"url":"https://medium.com/sylabs","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/hpcng/singularity/security/advisories/GHSA-6w7g-p4jh-rf92","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13846","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6w7g-p4jh-rf92"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13846","tags":["advisory"]},{"url":"https://github.com/sylabs/singularity","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-13846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13846","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3SAQ7VHOBJRH3RBUUMSP4FWX6EERZQLH/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174148","tags":["report"]},{"url":"https://bugzilla.suse.com/1174150","tags":["report"]},{"url":"https://bugzilla.suse.com/1174152","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13847","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EIHKRY3G2SS6X2ZY44CW67IIGHCJUYMO/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125369","tags":["report"]},{"url":"https://bugzilla.suse.com/1128598","tags":["report"]},{"url":"https://bugzilla.suse.com/1159550","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19724","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MUCKOMJKYSUD3KFNFD7KCBEF323WWHLF/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32635","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13846","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","status":"published","published":"2020-07-14T17:30:09Z","modified":"2024-08-04T12:32:13.079Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2021-2463","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","status":"published","published":"2020-07-14T17:30:09Z","modified":"2024-08-04T12:32:13Z","updated_at":"2026-11-03T03:07:36.182524Z"}],"ghsa":[{"id":"GHSA-6w7g-p4jh-rf92","title":"\"Verify All\" Returns Success Despite Validation Failures in Singularity","description":"### Impact\n\nThe `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.\n\nThe SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0`  are returned.\n\nWorkflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.\n\n```\n$ singularity verify -a image.sif \nWARNING: Missing signature for SIF descriptor 2 (JSON.Generic)\nWARNING: Missing signature for SIF descriptor 3 (FS)\nContainer is signed by 1 key(s):\n\nVerifying partition: Def.FILE:\n12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84\n[LOCAL]   Unit Test \u003cunit@test.com\u003e\n[OK]      Data integrity verified\n\nINFO:    Container verified: image.sif\n\n$ echo $?\n0\n```\n\n\n### Patches\n\nSingularity 3.6.0 has a new implementation of sign/verify that fixes this issue.\n\nAll users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity \u003c 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.\n\nVersion 3.6.0 includes a `--legacy-insecure` flag for the `singularity verify` command, that will perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format.\n\n### Workarounds\n\nIf you are unable to update to 3.6.0 ensure that you do not rely on the return code of `singularity verify --all / -a` as an indicator of trust in a container.\n\nNote that other issues in the sign/verify implementation in Singularity \u003c 3.6.0 allow additional means to introduce malicious behavior to a signed container.\n\n\n### For more information\n\nGeneral questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:\n\n* [Singularity Slack Channel](https://bit.ly/2m0g3lX)\n* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)\n\nAny sensitive security concerns should be directed to: security@sylabs.io\n\nSee our Security Policy here: https://sylabs.io/security-policy","status":"published","published":"2021-12-20T18:24:43Z","modified":"2023-01-20T22:03:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:36:14.033357Z"}],"nvd":[{"id":"CVE-2020-13846","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","status":"published","published":"2020-07-14T18:15:14.463Z","modified":"2026-06-17T02:53:46.13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:09.126752Z"}],"osv":[{"id":"ALPINE-CVE-2020-13846","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","status":"published","published":"2020-07-14T18:15:14.463Z","modified":"2026-11-03T06:32:23.820338475Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-13846","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","status":"published","published":"2020-07-14T18:15:14.463Z","modified":"2026-10-24T10:50:37.336966855Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"GHSA-6w7g-p4jh-rf92","title":"\"Verify All\" Returns Success Despite Validation Failures in Singularity","description":"### Impact\n\nThe `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.\n\nThe SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0`  are returned.\n\nWorkflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.\n\n```\n$ singularity verify -a image.sif \nWARNING: Missing signature for SIF descriptor 2 (JSON.Generic)\nWARNING: Missing signature for SIF descriptor 3 (FS)\nContainer is signed by 1 key(s):\n\nVerifying partition: Def.FILE:\n12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84\n[LOCAL]   Unit Test \u003cunit@test.com\u003e\n[OK]      Data integrity verified\n\nINFO:    Container verified: image.sif\n\n$ echo $?\n0\n```\n\n\n### Patches\n\nSingularity 3.6.0 has a new implementation of sign/verify that fixes this issue.\n\nAll users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity \u003c 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.\n\nVersion 3.6.0 includes a `--legacy-insecure` flag for the `singularity verify` command, that will perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format.\n\n### Workarounds\n\nIf you are unable to update to 3.6.0 ensure that you do not rely on the return code of `singularity verify --all / -a` as an indicator of trust in a container.\n\nNote that other issues in the sign/verify implementation in Singularity \u003c 3.6.0 allow additional means to introduce malicious behavior to a signed container.\n\n\n### For more information\n\nGeneral questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:\n\n* [Singularity Slack Channel](https://bit.ly/2m0g3lX)\n* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)\n\nAny sensitive security concerns should be directed to: security@sylabs.io\n\nSee our Security Policy here: https://sylabs.io/security-policy","status":"published","published":"2021-12-20T18:24:43Z","modified":"2026-07-08T06:28:00.293246663Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"UBUNTU-CVE-2020-13846","description":"Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.","status":"published","published":"2020-07-14T18:15:00Z","modified":"2026-05-20T16:04:08.505268074Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"openSUSE-SU-2020:1011-1","title":"Security update for singularity","description":"This update for singularity fixes the following issues:\n\n- New version 3.6.0. This version introduces a new signature format \nfor SIF images, and changes to the signing / verification code to address\nthe following security problems:\n  - CVE-2020-13845, boo#1174150\n  In Singularity 3.x versions below 3.6.0, issues allow the ECL to \n  be bypassed by a malicious user.\n  - CVE-2020-13846, boo#1174148\n  In Singularity 3.5 the --all / -a option to singularity verify \n  returns success even when some objects in a SIF container are not signed, \n  or cannot be verified.\n  - CVE-2020-13847, boo#1174152\n  In Singularity 3.x versions below 3.6.0, Singularity's sign and verify \n  commands do not sign metadata found in the global header or data object \n  descriptors of a SIF file, allowing an attacker to cause unexpected \n  behavior. A signed container may verify successfully, even when it has \n  been modified in ways that could be exploited to cause malicious behavior.\n\n- New features / functionalities\n  - A new '--legacy-insecure' flag to verify allows verification of SIF\n  signatures in the old, insecure format.\n  - A new '-l / --logs' flag for instance list that shows the paths \n  to instance STDERR / STDOUT log files.\n  - The --json output of instance list now include paths to \n  STDERR / STDOUT log files.\n  - Singularity now supports the execution of minimal Docker/OCI\n  containers that do not contain /bin/sh, e.g. docker://hello-world.\n  - A new cache structure is used that is concurrency safe on a filesystem that\n  supports atomic rename. If you downgrade to Singularity 3.5 or older after\n  using 3.6 you will need to run singularity cache clean.\n  - A plugin system rework adds new hook points that will allow the\n  development of plugins that modify behavior of the runtime. An image driver\n  concept is introduced for plugins to support new ways of handling image and\n  overlay mounts. Plugins built for \u003c=3.5 are not compatible with 3.6.\n  - The --bind flag can now bind directories from a SIF or ext3 image into a\n  container.\n  - The --fusemount feature to mount filesystems to a container via FUSE\n  drivers is now a supported feature (previously an experimental hidden flag).\n  - This permits users to mount e.g. sshfs and cvmfs filesystems to the\n  container at runtime.\n  - A new -c/--config flag allows an alternative singularity.conf to be\n  specified by the root user, or all users in an unprivileged installation.\n  - A new --env flag allows container environment variables to be set via the\n  Singularity command line.\n  - A new --env-file flag allows container environment variables to be set from\n  a specified file.\n  - A new --days flag for cache clean allows removal of items older than a\n  specified number of days. Replaces the --name flag which is not generally\n  useful as the cache entries are stored by hash, not a friendly name.\n\n- Changed defaults / behaviours\n - New signature format (see security fixes above).\n - Fixed spacing of singularity instance list to be dynamically changing \n based off of input lengths instead of fixed number of spaces to account\n for long instance names.\n - Environment variables prefixed with SINGULARITYENV_ always take\n precedence over variables without SINGULARITYENV_ prefix.\n - The %post build section inherits environment variables from the base image.\n - %files from ... will now follow symlinks for sources that are directly\n specified, or directly resolved from a glob pattern. It will not follow\n symlinks found through directory traversal. This mirrors Docker multi-stage\n COPY behaviour.\n - Restored the CWD mount behaviour of v2, implying that CWD path is not recreated\n inside container and any symlinks in the CWD path are not resolved anymore to\n determine the destination path inside container.\n - The %test build section is executed the same manner as singularity test image.\n --fusemount with the container: default directive will foreground the FUSE\n process. Use container-daemon: for previous behavior.\n\n- Deprecate -a / --all option to sign/verify as new signature behavior \n  makes this the default.\n- For more information about upstream changes, please check:\n  https://github.com/hpcng/singularity/blob/master/CHANGELOG.md\n- Removed --name flag for cache clean; replaced with --days.\n","status":"published","published":"2020-07-19T12:26:15Z","modified":"2026-02-04T02:18:21.486067Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:1037-1","title":"Security update for singularity","description":"This update for singularity fixes the following issues:\n\n- New version 3.6.0. This version introduces a new signature format \nfor SIF images, and changes to the signing / verification code to address\nthe following security problems:\n  - CVE-2020-13845, boo#1174150\n  In Singularity 3.x versions below 3.6.0, issues allow the ECL to \n  be bypassed by a malicious user.\n  - CVE-2020-13846, boo#1174148\n  In Singularity 3.5 the --all / -a option to singularity verify \n  returns success even when some objects in a SIF container are not signed, \n  or cannot be verified.\n  - CVE-2020-13847, boo#1174152\n  In Singularity 3.x versions below 3.6.0, Singularity's sign and verify \n  commands do not sign metadata found in the global header or data object \n  descriptors of a SIF file, allowing an attacker to cause unexpected \n  behavior. A signed container may verify successfully, even when it has \n  been modified in ways that could be exploited to cause malicious behavior.\n\n- New features / functionalities\n  - A new '--legacy-insecure' flag to verify allows verification of SIF\n  signatures in the old, insecure format.\n  - A new '-l / --logs' flag for instance list that shows the paths \n  to instance STDERR / STDOUT log files.\n  - The --json output of instance list now include paths to \n  STDERR / STDOUT log files.\n  - Singularity now supports the execution of minimal Docker/OCI\n  containers that do not contain /bin/sh, e.g. docker://hello-world.\n  - A new cache structure is used that is concurrency safe on a filesystem that\n  supports atomic rename. If you downgrade to Singularity 3.5 or older after\n  using 3.6 you will need to run singularity cache clean.\n  - A plugin system rework adds new hook points that will allow the\n  development of plugins that modify behavior of the runtime. An image driver\n  concept is introduced for plugins to support new ways of handling image and\n  overlay mounts. Plugins built for \u003c=3.5 are not compatible with 3.6.\n  - The --bind flag can now bind directories from a SIF or ext3 image into a\n  container.\n  - The --fusemount feature to mount filesystems to a container via FUSE\n  drivers is now a supported feature (previously an experimental hidden flag).\n  - This permits users to mount e.g. sshfs and cvmfs filesystems to the\n  container at runtime.\n  - A new -c/--config flag allows an alternative singularity.conf to be\n  specified by the root user, or all users in an unprivileged installation.\n  - A new --env flag allows container environment variables to be set via the\n  Singularity command line.\n  - A new --env-file flag allows container environment variables to be set from\n  a specified file.\n  - A new --days flag for cache clean allows removal of items older than a\n  specified number of days. Replaces the --name flag which is not generally\n  useful as the cache entries are stored by hash, not a friendly name.\n\n- Changed defaults / behaviours\n - New signature format (see security fixes above).\n - Fixed spacing of singularity instance list to be dynamically changing \n based off of input lengths instead of fixed number of spaces to account\n for long instance names.\n - Environment variables prefixed with SINGULARITYENV_ always take\n precedence over variables without SINGULARITYENV_ prefix.\n - The %post build section inherits environment variables from the base image.\n - %files from ... will now follow symlinks for sources that are directly\n specified, or directly resolved from a glob pattern. It will not follow\n symlinks found through directory traversal. This mirrors Docker multi-stage\n COPY behaviour.\n - Restored the CWD mount behaviour of v2, implying that CWD path is not recreated\n inside container and any symlinks in the CWD path are not resolved anymore to\n determine the destination path inside container.\n - The %test build section is executed the same manner as singularity test image.\n --fusemount with the container: default directive will foreground the FUSE\n process. Use container-daemon: for previous behavior.\n\n- Deprecate -a / --all option to sign/verify as new signature behavior \n  makes this the default.\n- For more information about upstream changes, please check:\n  https://github.com/hpcng/singularity/blob/master/CHANGELOG.md\n- Removed --name flag for cache clean; replaced with --days.\n","status":"published","published":"2020-07-23T04:22:25Z","modified":"2026-02-04T03:08:23.840117Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1100-1","title":"Security update for singularity","description":"This update for singularity fixes the following issues:\n\n- New version 3.6.0. This version introduces a new signature format \nfor SIF images, and changes to the signing / verification code to address\nthe following security problems:\n  - CVE-2020-13845, boo#1174150\n  In Singularity 3.x versions below 3.6.0, issues allow the ECL to \n  be bypassed by a malicious user.\n  - CVE-2020-13846, boo#1174148\n  In Singularity 3.5 the --all / -a option to singularity verify \n  returns success even when some objects in a SIF container are not signed, \n  or cannot be verified.\n  - CVE-2020-13847, boo#1174152\n  In Singularity 3.x versions below 3.6.0, Singularity's sign and verify \n  commands do not sign metadata found in the global header or data object \n  descriptors of a SIF file, allowing an attacker to cause unexpected \n  behavior. A signed container may verify successfully, even when it has \n  been modified in ways that could be exploited to cause malicious behavior.\n\n- New features / functionalities\n  - A new '--legacy-insecure' flag to verify allows verification of SIF\n  signatures in the old, insecure format.\n  - A new '-l / --logs' flag for instance list that shows the paths \n  to instance STDERR / STDOUT log files.\n  - The --json output of instance list now include paths to \n  STDERR / STDOUT log files.\n  - Singularity now supports the execution of minimal Docker/OCI\n  containers that do not contain /bin/sh, e.g. docker://hello-world.\n  - A new cache structure is used that is concurrency safe on a filesystem that\n  supports atomic rename. If you downgrade to Singularity 3.5 or older after\n  using 3.6 you will need to run singularity cache clean.\n  - A plugin system rework adds new hook points that will allow the\n  development of plugins that modify behavior of the runtime. An image driver\n  concept is introduced for plugins to support new ways of handling image and\n  overlay mounts. Plugins built for \u003c=3.5 are not compatible with 3.6.\n  - The --bind flag can now bind directories from a SIF or ext3 image into a\n  container.\n  - The --fusemount feature to mount filesystems to a container via FUSE\n  drivers is now a supported feature (previously an experimental hidden flag).\n  - This permits users to mount e.g. sshfs and cvmfs filesystems to the\n  container at runtime.\n  - A new -c/--config flag allows an alternative singularity.conf to be\n  specified by the root user, or all users in an unprivileged installation.\n  - A new --env flag allows container environment variables to be set via the\n  Singularity command line.\n  - A new --env-file flag allows container environment variables to be set from\n  a specified file.\n  - A new --days flag for cache clean allows removal of items older than a\n  specified number of days. Replaces the --name flag which is not generally\n  useful as the cache entries are stored by hash, not a friendly name.\n\n- Changed defaults / behaviours\n - New signature format (see security fixes above).\n - Fixed spacing of singularity instance list to be dynamically changing \n based off of input lengths instead of fixed number of spaces to account\n for long instance names.\n - Environment variables prefixed with SINGULARITYENV_ always take\n precedence over variables without SINGULARITYENV_ prefix.\n - The %post build section inherits environment variables from the base image.\n - %files from ... will now follow symlinks for sources that are directly\n specified, or directly resolved from a glob pattern. It will not follow\n symlinks found through directory traversal. This mirrors Docker multi-stage\n COPY behaviour.\n - Restored the CWD mount behaviour of v2, implying that CWD path is not recreated\n inside container and any symlinks in the CWD path are not resolved anymore to\n determine the destination path inside container.\n - The %test build section is executed the same manner as singularity test image.\n --fusemount with the container: default directive will foreground the FUSE\n process. Use container-daemon: for previous behavior.\n\n- Deprecate -a / --all option to sign/verify as new signature behavior \n  makes this the default.\n- For more information about upstream changes, please check:\n  https://github.com/hpcng/singularity/blob/master/CHANGELOG.md\n- Removed --name flag for cache clean; replaced with --days.\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-07-27T16:19:21Z","modified":"2026-02-04T02:20:17.551337Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11384-1","title":"singularity-3.8.3-1.2 on GA media","description":"These are all security issues fixed in the singularity-3.8.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:28.928556Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}