openSUSE Leap 15.1: 2020:1037-1 Important: Singularity Security Issues

This update for singularity fixes the following issues:

- New version 3.6.0. This version introduces a new signature format for

SIF images, and changes to the signing / verification code to address

the following security problems:

- CVE-2020-13845, boo#1174150 In Singularity 3.x versions below 3.6.0,

issues allow the ECL to be bypassed by a malicious user.

- CVE-2020-13846, boo#1174148 In Singularity 3.5 the --all / -a option

to singularity verify returns success even when some objects in a SIF

container are not signed,

or cannot be verified.

- CVE-2020-13847, boo#1174152 In Singularity 3.x versions below 3.6.0,

Singularity's sign and verify commands do not sign metadata found in

the global header or data object descriptors of a SIF file, allowing

an attacker to cause unexpected behavior. A signed container may

verify successfully, even when it has been modified in ways that could

be...