CVE catalog

CVE-2022-39237

golang-github-sylabs-sif: CVE-2022-39237

[CVE catalog]

Severity
Medium · CVSS 6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.66% · Oct 25, 2026

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-sylabs-sifsid2.24.1-1fixed
Debiangolang-github-sylabs-sifforky2.24.1-1fixed
Debiangolang-github-sylabs-siftrixie2.21.0-1fixed
Debiangolang-github-sylabs-sifbookworm2.8.3-1fixed
Ubuntusingularity-containerpro4.1.1+ds2-1vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1build1vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1ubuntu0.1vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1ubuntu0.2vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1ubuntu0.2+esm1vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1ubuntu0.3vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1ubuntu0.3+esm1vulnerable
Ubuntusingularity-containerpro4.1.1+ds2-1ubuntu0.3+esm2vulnerable
Ubuntugolang-github-sylabs-sif20.041.0.9-1vulnerable
Ubuntugolang-github-sylabs-sif22.041.0.9-2.1vulnerable
Ubuntugolang-github-sylabs-sif22.041.0.9-2.1build1vulnerable
Ubuntugolang-github-sylabs-sif22.041.0.9-2.1ubuntu0.1vulnerable
Ubuntusingularity-container25.104.1.5+ds4-1vulnerable
Ubuntusingularity-container26.044.1.5+ds4-1vulnerable
Opensuseapptainertumbleweed1.1.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-sylabs-sifsourcesid2.8.3-1not yet assignedNot reported[1023570]
Debiangolang-github-sylabs-sifsourceforky2.8.3-1not yet assignedNot reported[1023570]
Debiangolang-github-sylabs-sifsourcetrixie2.8.3-1not yet assignedNot reported[1023570]
Debiangolang-github-sylabs-sifsourcebookworm2.8.3-1not yet assignedNot reported[1023570]
Opensuseapptainerrpmtumbleweed1.1.2-1.1Not reportedOPENSUSE-SU-2024:12389-1Not reported

[Debian bug #1023570]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [apptainer-leap]Unknown

    Source package: [apptainer]

    Details (1)

    • 1.5.3-2.1 · noarch · tumbleweed

      Unknown · Fixed: 1.1.2-1.1

      Version impact unknown

      dsa · apptainer · opensuse · tumbleweed

  • [apptainer]Fixed

    Source package: [apptainer]

    Details (1)

    • 1.5.3-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.1.2-1.1

      dsa · apptainer · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [golang-github-sylabs-sif-dev]Fixed

    Source package: [golang-github-sylabs-sif]

    Details (2)

    • 2.8.3-1 · all · bookworm

      Fixed · Fixed: 2.8.3-1

      dsa · golang-github-sylabs-sif · debian · bookworm

    • 2.8.3-1 · all · bookworm

      Fixed · Fixed: 2.8.3-1

      dsa · golang-github-sylabs-sif · debian · bookworm

  • [siftool]Fixed

    Source package: [golang-github-sylabs-sif]

    Details (2)

    • 2.8.3-1+b5 · amd64 · bookworm

      Fixed · Fixed: 2.8.3-1

      dsa · golang-github-sylabs-sif · debian · bookworm

    • 2.8.3-1+b5 · arm64 · bookworm

      Fixed · Fixed: 2.8.3-1

      dsa · golang-github-sylabs-sif · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]