CVE-2019-11328
An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within /run/singularity/instances/sing//. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory github.com
- report openwall.com
- web securityfocus.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org