openSUSE: 2020:1529-1 Moderate: Singularity Security Issues Summary

This update for singularity fixes the following issues:

New version 3.6.3, addresses the following security issues:

- CVE-2020-25039, boo#1176705

When a Singularity action command (run, shell, exec) is run with the

fakeroot or user namespace option, Singularity will extract a container

image to a temporary sandbox directory. Due to insecure permissions on the

temporary directory it is possible for any user with access to the system

to read the contents of the image. Additionally, if the image contains a

world-writable file or directory, it is possible for a user to inject

arbitrary content into the running container.

- CVE-2020-25040, boo#1176707

When a Singularity command that results in a container build operation

is executed, it is possible for a user with access to the system to read

the contents of the image during the build. Additionally, if the image

contains a world-writable file or directory, it is possible for a user to

...