{"id":"CVE-2022-39237","published":"2022-10-06T00:00:00Z","modified":"2025-04-23T16:53:04Z","title":"Digital Signature Hash Algorithms Not Validated in sylabs/sif","vendor":"sylabs","product":"sif","tier":"tail","description":{"text":"syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0065,"percentile":0.51068,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8","tags":[]},{"url":"https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa","tags":[]},{"url":"https://security.gentoo.org/glsa/202210-19","tags":["vendor-advisory"]}],"priority":{"score":14.6,"factors":[{"name":"EPSS percentile","points":10.21},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"sylabs","affectedVersions":[{"vendor":"sylabs","product":"sif","versions":["< 2.8.1"]}],"affected":[{"ecosystem":"Go","package":"github.com/sylabs/sif/v2","vulnerableRanges":["<2.8.1"],"patched":["2.8.1"],"from":["GHSA-m5m3-46gj-wch8","GO-2022-1045"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7123","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sylabs-sif-cve-2004-2761","parents":[{"from":"CVE-2004-2761","to":"CVE-2022-39237","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-m5m3-46gj-wch8","via":"reference","url":"https://nvd.nist.gov/vuln/detail/cve-2004-2761"}]},{"from":"CVE-2005-4900","to":"CVE-2022-39237","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-m5m3-46gj-wch8","via":"reference","url":"https://nvd.nist.gov/vuln/detail/cve-2005-4900"}]}]}}