CVE-2022-39237CWE-347

Digital Signature Hash Algorithms Not Validated in sylabs/sif

Medium · published October 6, 2022

CVSS v3.1
6.3
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00640 · 50.0th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2022-10-06T00:00Z
EPSS history
Timeline
  • 06 OCT 00:00Z
    Digital Signature Hash Algorithms Not Validated in sylabs/sif
    cvelistv5