hpcng/singularity: Singularity 3.6.4
Authors/Creators
- Gregory M. Kurtzer1
- cclerget
- Michael Bauer2
- Ian Kaneshiro
- David Godlove3
- Vanessasaurus
- David Trudgian4
- Yannick Cote5
- Geoffroy Vallee
- DrDaveD
- Adam Hughes3
- Justin Cook6
- Jason Stover
- Brian P Bockelman7
- Marcelo Magallon8
- Jacob Chappell9
- Daniele Tamino
- Carlos Arango Gutierrez10
- Carl Madison
- Sasha Yakovtseva
- Mike Frisch
- Dave Love
- Amanda Duffy11
- Satrajit Ghosh12
- VP
- Tru Huynh13
- Mike Gray14
- Yaroslav Halchenko15
- 1. Singularity Labs
- 2. Facebook
- 3. Sylabs Inc
- 4. @sylabs
- 5. Red Hat
- 6. @Linaro
- 7. Morgridge Institute for Research
- 8. @grafana
- 9. Chappell Consulting & Tutoring
- 10. @RedHatOfficial
- 11. Lenovo
- 12. MIT
- 13. Unité de Bioinformatique Structurale, Institut Pasteur
- 14. Self
- 15. Dartmouth College, @Debian, @DataLad, @PyMVPA, @fail2ban
Description
Singularity 3.6.4 is an important security release. Please read the release notes below carefully.
Security related fixesSingularity 3.6.4 addresses the following security issues.
- CVE-2020-15229: Due to insecure handling of path traversal and the lack of path sanitization within unsquashfs (a distribution provided utility used by Singularity), it is possible to overwrite/create files on the host filesystem during the extraction of a crafted squashfs filesystem. Affects unprivileged execution of SIF / SquashFS images, and image builds from SIF / SquashFS images.
Please see the published security advisories at https://github.com/hpcng/singularity/security/advisories for full detail of these security issues.
Bug Fixes- Update scs-library-client to support library:// backends using a 3rd party S3 object store that does not strictly conform to v4 signature spec.
In keeping with their commitment to the open source community to release security patches incorporated into SingularityPRO, Sylabs is releasing the following diffs that contain security content only:
3.1: https://repo.sylabs.io/security/2020/CVE-2020-15229-31.diff 3.5: https://repo.sylabs.io/security/2020/CVE-2020-15229-35.diff
Thanks to our contributors for code, feedback and, testing efforts!
As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new
If you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Have fun!
Files
hpcng/singularity-v3.6.4.zip
Files
(2.1 MB)
| Name | Size | Download all |
|---|---|---|
|
md5:4c16411d9b05ba103a8d9bc6fab39aa1
|
2.1 MB | Preview Download |
Additional details
Related works
- Is supplement to
- https://github.com/hpcng/singularity/tree/v3.6.4 (URL)