Insecure Defaults Affecting github.com/hpcng/singularity/e2e/actions package, versions <3.7.4
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMHPCNGSINGULARITYE2EACTIONS-1309668
- published 16 Jun 2021
- disclosed 16 Jun 2021
- credit Unknown
Introduced: 16 Jun 2021
CVE-2021-33622 Open this link in a new tabHow to fix?
Upgrade github.com/hpcng/singularity/e2e/actions to version 3.7.4 or higher.
Overview
Affected versions of this package are vulnerable to Insecure Defaults. An action command singularity run/shell/exec against a container specified via a library:// URI can be configured to retrieve the container from a custom library service via the singularity remote command. If the custom remote endpoint is unavailable, or does not return a correct response, the action command will incorrectly fall back to use the default cloud.sylabs.io endpoint.
An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint. If the user's configured custom remote is inaccessible, either by co-incidence or through malicious action, a user may execute the malicious container.
This advisory differs from CVE-2021-32635 as incorrect use of the default remote is restricted to the case when the custom remote is unavailable.
Users who only interact with the default remote endpoint are not affected.