CVE-2020-25040

HIGH

Sylabs Singularity < 3.6.2 - Exposure to Wrong Actor

Title source: rule

Description

Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.

References (4)

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00070.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00088.html

[Mitigation, Third Party Advisory] https://github.com/hpcng/singularity/security/advisories/GHSA-jv9c-w74q-6762

[Product] https://medium.com/sylabs

Scores

CVSS v3 8.8

EPSS 0.0074

EPSS Percentile 72.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-668

Status published

Affected Products (4)

sylabs/singularity < 3.6.2

opensuse/leap

sylabs/singularity < 3.6.3Go

Timeline

Published Sep 16, 2020

Tracked Since Feb 18, 2026