x/vulndb: potential Go vuln in github.com/sylabs/singularity: GHSA-mj73-5x75-9phh

[GoVulnBot]

In GitHub Security Advisory GHSA-mj73-5x75-9phh, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/sylabs/singularity		>= 3.3.0, <= 3.5.1

Cross references:

• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity/internal/pkg/runtime/engines/singularity: GHSA-557g-r22w-9wvx #791 NOT_IMPORTABLE
• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity: CVE-2020-13845, GHSA-pmfr-63c2-jr5c #898 NOT_IMPORTABLE
• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity: CVE-2020-13846, GHSA-6w7g-p4jh-rf92 #899 NOT_IMPORTABLE
• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity: CVE-2020-15229, GHSA-7gcp-w6ww-2xv9 #900 NOT_IMPORTABLE
• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity: CVE-2020-25039, GHSA-w6v2-qchm-grj7 #901 NOT_IMPORTABLE
• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity: CVE-2020-25040, GHSA-jv9c-w74q-6762 #902 NOT_IMPORTABLE
• Module github.com/sylabs/singularity appears in issue x/vulndb: potential Go vuln in github.com/sylabs/singularity: CVE-2021-32635, GHSA-5mv9-q7fq-9394 #916 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/sylabs/singularity
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 3.3.0, <= 3.5.1")
      vulnerable_at: 0.0.0-20230718133150-0ccef06bd874
      packages:
        - package: github.com/sylabs/singularity
summary: Singularity insecure permissions
description: |-
    Insecure permissions (777) are set on `$HOME/.singularity` when it is newly
    created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an
    information leak, and malicious redirection of operations performed against
    Sylabs cloud services.
cves:
    - CVE-2019-19724
ghsas:
    - GHSA-mj73-5x75-9phh
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-19724
    - web: https://github.com/sylabs/singularity/releases/tag/v3.5.2
    - web: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html
    - web: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
    - advisory: https://github.com/advisories/GHSA-mj73-5x75-9phh

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports