ScholarLens Back to search
2021•Zenodo (CERN European Organization for Nuclear Research)Open access

hpcng/singularity: Singularity 3.7.3

Gregory M. Kurtzer, cclerget, Michael Bauer, Ian Kaneshiro, David C. Trudgian, David Godlove

Open full text 23 citations

Abstract

Singularity 3.7.3 is a security release. We recommend all users upgrade to this version. Security Related Fixes CVE-2021-29136: A dependency used by Singularity to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"), when running as root. This vulnerability affects a singularity build or singularity pull as root, from a docker or OCI source. Thanks / Reporting Bugs Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun! Downloads Please use the singularity-3.7.3.tar.gz download below to obtain and install Singularity 3.7.3. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.

About this research paper

What this paper is about

Singularity 3.7.3 is a security release. We recommend all users upgrade to this version. Security Related Fixes CVE-2021-29136: A dependency used by Singularity to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"), when running as root. This vulnerability affects a singularity build or singularity pull as root, from a docker or OCI source. Thanks / Reporting Bugs Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun! Downloads Please use the singularity-3.7.3.tar.gz download below to obtain and install Singularity 3.7.3. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.

Why it matters

OpenAlex reports 23 citations for this work. Citation counts describe recorded attention and do not establish research quality.

Key contribution

A contribution statement is not available in the OpenAlex record.

Method / approach

Method details are not available in the OpenAlex metadata.

Main findings

Findings are not separately available in the OpenAlex metadata.

Limitations

Limitations are not available in the OpenAlex metadata.

Applications

Application details are not available in the OpenAlex metadata.

Available abstract

Singularity 3.7.3 is a security release. We recommend all users upgrade to this version. Security Related Fixes CVE-2021-29136: A dependency used by Singularity to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"), when running as root. This vulnerability affects a singularity build or singularity pull as root, from a docker or OCI source. Thanks / Reporting Bugs Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun! Downloads Please use the singularity-3.7.3.tar.gz download below to obtain and install Singularity 3.7.3. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.

Key concepts: Singularity, Essential singularity, Mathematics, Mathematical analysis

Related papers

Related paper 1Related paper 2Related paper 3
Back to paper searchBrowse research topicsOriginal source
hpcng/singularity: Singularity 3.7.3 — Research Paper | ScholarLens