https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:21:26.478954+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-52438 cnvd-2020-52438 2026-10-06T01:21:26.485213+00:00 cnvd-2020-52438 https://cve.radiocsirt.org/vuln/euvd-2026-42034 EUVD-2026-42034 2026-10-06T01:21:26.485248+00:00 EUVD-2026-42034 https://cve.radiocsirt.org/vuln/fkie_cve-2020-13845 fkie_cve-2020-13845 2026-10-06T01:21:26.485262+00:00

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

 https://cve.radiocsirt.org/vuln/ghsa-pmfr-63c2-jr5c GHSA-pmfr-63c2-jr5c — Execution Control List (ECL) Is Insecure in Singularity 2026-10-06T01:21:26.485291+00:00

Affected: Go: github.com/sylabs/singularity

### Impact

The Singularity Execution Control List (ECL) allows system administrators to set up a policy that defines rules about what signature(s) must be (or must not be) present on a SIF container image for it to be permitted to run.

In Singularity 3.x versions below 3.6.0, the following issues allow the ECL to be bypassed by a malicious user:

* Image integrity is not validated when an ECL policy is enforced. * The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. Thus, it is trivial to craft an arbitrary payload which will be permitted to run, even if the attacker does not have access to the private key associated with the fingerprint(s) configured in the ECL.

### Patches

These issues are addressed in Singularity 3.6.0.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `legacyinsecure` option that can be set to `legacyinsecure = true` in `ecl.toml` to allow the ECL to perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format. The option should be used only to temporarily ease the t…

 https://cve.radiocsirt.org/vuln/gsd-2020-13845 gsd-2020-13845 2026-10-06T01:21:26.485338+00:00 gsd-2020-13845 https://cve.radiocsirt.org/vuln/opensuse-su-2020:1011-1 openSUSE-SU-2020:1011-1 — Security update for singularity 2026-10-06T01:21:26.485351+00:00

Security update for singularity

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-13845 UBUNTU-CVE-2020-13845 2026-10-06T01:21:26.485367+00:00

Affected: Ubuntu:Pro:18.04:LTS: singularity-container, Ubuntu:Pro:24.04:LTS: singularity-container, Ubuntu:25.10: singularity-container, Ubuntu:26.04:LTS: singularity-container

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.