CVE-2019-19724: Singularity insecure permissions
Summary
CVE-2019-19724: Singularity insecure permissions. Affects github.com/sylabs/singularity versions >= 3.3.0, < 3.5.2. Fixed in 3.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Singularity is an open-source container platform designed to enable secure and reproducible scientific workflows. It allows users to create and run containers that encapsulate their applications and dependencies. Singularity versions from 3.3.0 to 3.5.1 are affected by an insecure permissions vulnerability. When Singularity creates the $HOME/.singularity directory, it sets insecure permissions (777) on it. This vulnerability could potentially lead to an information leak and malicious redirection of operations performed against Sylabs cloud services.
Vulnerability Detail
The insecure permissions (777) set on the $HOME/.singularity directory can allow unauthorized access to sensitive information stored within the directory. An attacker could exploit this vulnerability to read or modify files, potentially leading to the exposure of confidential data or the execution of unauthorized actions against Sylabs cloud services. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/sylabs/singularity@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.2
This is the first release that contains the fix.
go get github.com/sylabs/singularity@v3.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the permissions of the $HOME/.singularity directory to restrict access. The recommended permissions are 700, which only allow the owner to read, write, and execute files within the directory. To change the permissions, execute the following command:
chmod 700 $HOME/.singularity
Conclusion
In summary, Singularity versions 3.3.0 to 3.5.1 are affected by an insecure permissions vulnerability that can lead to information leaks and unauthorized operations against Sylabs cloud services. Users should update to a non-affected version of Singularity to mitigate this issue. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/sylabs/singularity →
FAQ
Singularity is an open-source container platform used for creating and running containers that encapsulate scientific workflows.
Versions 3.3.0 to 3.5.1 of Singularity are affected by this insecure permissions vulnerability.
This vulnerability could result in an information leak and unauthorized operations against Sylabs cloud services.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, update to a Singularity version beyond 3.5.1.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sylabs/singularity.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
