cnvd-2020-52439

EUVD-2026-42036

fkie_cve-2020-13846

Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

GHSA-6w7g-p4jh-rf92 — "Verify All" Returns Success Despite Validation Failures in Singularity

Affected: Go: github.com/sylabs/singularity

### Impact

The `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.

The SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0` are returned.

Workflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.

``` $ singularity verify -a image.sif WARNING: Missing signature for SIF descriptor 2 (JSON.Generic) WARNING: Missing signature for SIF descriptor 3 (FS) Container is signed by 1 key(s):

Verifying partition: Def.FILE: 12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84 [LOCAL] Unit Test <unit@test.com> [OK] Data integrity verified

INFO: Container verified: image.sif

$ echo $? 0 ```

### Patches

Singularity 3.6.0 has a new implementation of sign/verify that fixes this issue.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `--legacy-insecure` flag for the `singularity verify` command, that will perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that con…

openSUSE-SU-2020:1011-1 — Security update for singularity

Security update for singularity

UBUNTU-CVE-2020-13846

Affected: Ubuntu:Pro:18.04:LTS: singularity-container, Ubuntu:Pro:24.04:LTS: singularity-container, Ubuntu:25.10: singularity-container, Ubuntu:26.04:LTS: singularity-container