CVE-2020-13845

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

• CWE-347
• CWE-354

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.htmlBroken Link
• https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5cThird Party Advisory
• https://medium.com/sylabsThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.htmlBroken Link
• https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5cThird Party Advisory
• https://medium.com/sylabsThird Party Advisory

Published

Jul 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1384An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13840An issue was discovered on LG mobile devices with Android OS…9.8
• CVE-2020-13841An issue was discovered on LG mobile devices with Android OS…9.8
• CVE-2020-13842An issue was discovered on LG mobile devices with Android OS…7.8
• CVE-2020-13843An issue was discovered on LG mobile devices with Android OS…5.5
• CVE-2020-13844Arm Armv8-A core implementations utilizing speculative execu…5.5
• CVE-2020-13846Sylabs Singularity 3.5.0 through 3.5.3 fails to report an er…7.5
• CVE-2020-13847Sylabs Singularity 3.0 through 3.5 lacks support for an Inte…7.5
• CVE-2020-13848Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows re…7.5
• CVE-2020-13849The MQTT protocol 3.1.1 requires a server to set a timeout v…7.5
• CVE-2020-1385An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13850Artica Pandora FMS 7.44 has inadequate access controls on a …7.5