CVE-2022-39237 Digital Signature Hash Algorithms Not Validated in sylabs/sif

2022-10-0600:00:00

CWE-347

GitHub_M

www.cve.org

cve-2022-39237

sylabs/sif

digital signature

hash algorithms

upgrade

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.4%

JSON

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

CNA Affected

[
  {
    "vendor": "sylabs",
    "product": "sif",
    "versions": [
      {
        "version": "< 2.8.1",
        "status": "affected"
      }
    ]
  }
]