openSUSE: 2021:1525-1 moderate: singularity

Advisories


   openSUSE Security Update: Security update for singularity
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2021:1525-1
Rating:             moderate
References:         #1193273 
Cross-References:   CVE-2021-41190
CVSS scores:
                    CVE-2021-41190 (NVD) : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Affected Products:
                    openSUSE Backports SLE-15-SP3
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for singularity fixes the following issues:

   Update to 3.8.5:

   - CVE-2021-41190: Fixed OCI manifest and index parsing confusion
     (boo#1193273).
   - Building Singularity from source requires go greater or equal 1.16. We
     now aim to support the two most recent stable versions of Go. This
     corresponds to the Go Release Maintenance Policy
   - Sourcing a script based on PATH is now permitted, fixing a regression
     introduced in 3.6.0.
   - Environment variables in container definition files are properly scoped,
     fixing a regression introduced in 3.8.0.
   - Fix the oras contexts to avoid hangs upon failed pushes to Harbor
     registry.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP3:

      zypper in -t patch openSUSE-2021-1525=1



Package List:

   - openSUSE Backports SLE-15-SP3 (aarch64 i586 s390x x86_64):

      singularity-3.8.5-bp153.2.10.1


References:

   https://www.suse.com/security/cve/CVE-2021-41190.html
   https://bugzilla.suse.com/1193273

openSUSE: 2021:1525-1 moderate: singularity

December 4, 2021
An update that fixes one vulnerability is now available

Description

This update for singularity fixes the following issues: Update to 3.8.5: - CVE-2021-41190: Fixed OCI manifest and index parsing confusion (boo#1193273). - Building Singularity from source requires go greater or equal 1.16. We now aim to support the two most recent stable versions of Go. This corresponds to the Go Release Maintenance Policy - Sourcing a script based on PATH is now permitted, fixing a regression introduced in 3.6.0. - Environment variables in container definition files are properly scoped, fixing a regression introduced in 3.8.0. - Fix the oras contexts to avoid hangs upon failed pushes to Harbor registry.

Patch

To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1525=1

Package List

- openSUSE Backports SLE-15-SP3 (aarch64 i586 s390x x86_64): singularity-3.8.5-bp153.2.10.1

References

https://www.suse.com/security/cve/CVE-2021-41190.html https://bugzilla.suse.com/1193273

Severity
Announcement ID: openSUSE-SU-2021:1525-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP3 .

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.