CVE-2022-39237

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

• CWE-347
• CWE-327

• https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaaPatch, Third Party Advisory
• https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8Third Party Advisory
• https://security.gentoo.org/glsa/202210-19Third Party Advisory
• https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaaPatch, Third Party Advisory
• https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8Third Party Advisory
• https://security.gentoo.org/glsa/202210-19Third Party Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39230fhir-works-on-aws-authz-smart is an implementation of the au…6.5
• CVE-2022-39231Parse Server is an open source backend that can be deployed …3.7
• CVE-2022-39232Discourse is an open source discussion platform. Starting wi…4.3
• CVE-2022-39233Tuleap is a Free & Open Source Suite to improve management o…5.4
• CVE-2022-39234GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…8.8
• CVE-2022-39236Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…5.3
• CVE-2022-39238Arvados is an open source platform for managing and analyzin…8.8
• CVE-2022-39239netlify-ipx is an on-Demand image optimization for Netlify u…5.4
• CVE-2022-3924This issue can affect BIND 9 resolvers with `stale-answer-en…7.5
• CVE-2022-39240MyGraph is a permission management system. Versions prior to…5.4
• CVE-2022-39241Discourse is a platform for community discussion. A maliciou…4.9
• CVE-2022-39242Frontier is an Ethereum compatibility layer for Substrate. P…5.3