CVE-2022-39237

Name of the Vulnerable Software and Affected Versions syslabs/sif versions prior to 2.8.1

Description The issue concerns the verification of digital signatures in the Singularity Image Format (SIF) reference implementation. Specifically, the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. Users are encouraged to upgrade to a version where this issue is fixed. For users unable to upgrade, it is recommended to independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

Recommendations For versions prior to 2.8.1, upgrade to version 2.8.1 or later. As a temporary workaround for users unable to upgrade, consider independently validating the hash algorithm(s) used for metadata digest(s) and signature hash to ensure they are cryptographically secure.