Linux Security
    Linux Security
    Linux Security

    openSUSE: 2020:1037-1: important: singularity

    Date
    184
    Posted By
    An update that solves 5 vulnerabilities and has one errata is now available.
       openSUSE Security Update: Security update for singularity
    ______________________________________________________________________________
    
    Announcement ID:    openSUSE-SU-2020:1037-1
    Rating:             important
    References:         #1125369 #1128598 #1159550 #1174148 #1174150 
                        #1174152 
    Cross-References:   CVE-2019-11328 CVE-2019-19724 CVE-2020-13845
                        CVE-2020-13846 CVE-2020-13847
    Affected Products:
                        openSUSE Leap 15.1
    ______________________________________________________________________________
    
       An update that solves 5 vulnerabilities and has one errata
       is now available.
    
    Description:
    
       This update for singularity fixes the following issues:
    
       - New version 3.6.0. This version introduces a new signature format for
         SIF images, and changes to the signing / verification code to address
         the following security problems:
         - CVE-2020-13845, boo#1174150 In Singularity 3.x versions below 3.6.0,
           issues allow the ECL to be bypassed by a malicious user.
         - CVE-2020-13846, boo#1174148 In Singularity 3.5 the --all / -a option
           to singularity verify returns success even when some objects in a SIF
           container are not signed,
         or cannot be verified.
         - CVE-2020-13847, boo#1174152 In Singularity 3.x versions below 3.6.0,
           Singularity's sign and verify commands do not sign metadata found in
           the global header or data object descriptors of a SIF file, allowing
           an attacker to cause unexpected behavior. A signed container may
           verify successfully, even when it has been modified in ways that could
           be exploited to cause malicious behavior.
    
       - New features / functionalities
         - A new '--legacy-insecure' flag to verify allows verification of SIF
           signatures in the old, insecure format.
         - A new '-l / --logs' flag for instance list that shows the paths to
           instance STDERR / STDOUT log files.
         - The --json output of instance list now include paths to STDERR /
           STDOUT log files.
         - Singularity now supports the execution of minimal Docker/OCI
           containers that do not contain /bin/sh, e.g. docker://hello-world.
         - A new cache structure is used that is concurrency safe on a filesystem
           that supports atomic rename. If you downgrade to Singularity 3.5 or
           older after using 3.6 you will need to run singularity cache clean.
         - A plugin system rework adds new hook points that will allow the
           development of plugins that modify behavior of the runtime. An image
           driver concept is introduced for plugins to support new ways of
           handling image and
         overlay mounts. Plugins built for <=3.5 are not compatible with 3.6.
         - The --bind flag can now bind directories from a SIF or ext3 image into
           a container.
         - The --fusemount feature to mount filesystems to a container via FUSE
           drivers is now a supported feature (previously an experimental hidden
           flag).
         - This permits users to mount e.g. sshfs and cvmfs filesystems to the
           container at runtime.
         - A new -c/--config flag allows an alternative singularity.conf to be
           specified by the root user, or all users in an unprivileged
           installation.
         - A new --env flag allows container environment variables to be set via
           the Singularity command line.
         - A new --env-file flag allows container environment variables to be set
           from a specified file.
         - A new --days flag for cache clean allows removal of items older than a
           specified number of days. Replaces the --name flag which is not
           generally useful as the cache entries are stored by hash, not a
           friendly name.
    
       - Changed defaults / behaviours
        - New signature format (see security fixes above).
        - Fixed spacing of singularity instance list to be dynamically changing
          based off of input lengths instead of fixed number of spaces to account
          for long instance names.
        - Environment variables prefixed with SINGULARITYENV_ always take
          precedence over variables without SINGULARITYENV_ prefix.
        - The %post build section inherits environment variables from the base
          image.
        - %files from ... will now follow symlinks for sources that are directly
          specified, or directly resolved from a glob pattern. It will not follow
          symlinks found through directory traversal. This mirrors Docker
          multi-stage COPY behaviour.
        - Restored the CWD mount behaviour of v2, implying that CWD path is not
          recreated inside container and any symlinks in the CWD path are not
          resolved anymore to determine the destination path inside container.
        - The %test build section is executed the same manner as singularity test
          image.
        --fusemount with the container: default directive will foreground the
         FUSE process. Use container-daemon: for previous behavior.
    
       - Deprecate -a / --all option to sign/verify as new signature behavior
         makes this the default.
       - For more information about upstream changes, please check:
         https://github.com/hpcng/singularity/blob/master/CHANGELOG.md
       - Removed --name flag for cache clean; replaced with --days.
    
    
    Patch Instructions:
    
       To install this openSUSE Security Update use the SUSE recommended installation methods
       like YaST online_update or "zypper patch".
    
       Alternatively you can run the command listed for your product:
    
       - openSUSE Leap 15.1:
    
          zypper in -t patch openSUSE-2020-1037=1
    
    
    
    Package List:
    
       - openSUSE Leap 15.1 (x86_64):
    
          singularity-3.6.0-lp151.2.6.1
          singularity-debuginfo-3.6.0-lp151.2.6.1
    
    
    References:
    
       https://www.suse.com/security/cve/CVE-2019-11328.html
       https://www.suse.com/security/cve/CVE-2019-19724.html
       https://www.suse.com/security/cve/CVE-2020-13845.html
       https://www.suse.com/security/cve/CVE-2020-13846.html
       https://www.suse.com/security/cve/CVE-2020-13847.html
       https://bugzilla.suse.com/1125369
       https://bugzilla.suse.com/1128598
       https://bugzilla.suse.com/1159550
       https://bugzilla.suse.com/1174148
       https://bugzilla.suse.com/1174150
       https://bugzilla.suse.com/1174152
    
    -- 
    

    Advisories

    LinuxSecurity Poll

    How are you contributing to Open Source?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 4 answer(s).
    /main-polls/37-how-are-you-contributing-to-open-source?task=poll.vote&format=json
    37
    radio
    [{"id":"127","title":"I'm involved with the development of an open-source project(s).","votes":"1","type":"x","order":"1","pct":100,"resources":[]},{"id":"128","title":"I've reported vulnerabilities I've discovered in open-source code.","votes":"0","type":"x","order":"2","pct":0,"resources":[]},{"id":"129","title":"I've provided developers with feedback on their projects.","votes":"0","type":"x","order":"3","pct":0,"resources":[]},{"id":"130","title":"I've helped another community member get started contributing to Open Source.","votes":"0","type":"x","order":"4","pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.