CVE-2020-13845: Insecure Execution Control List (ECL) in Singularity
Summary
CVE-2020-13845: Execution Control List (ECL) Is Insecure in Singularity. Affects github.com/sylabs/singularity versions >= 3.0.0, < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Singularity is an open-source container platform designed to run applications in a secure and isolated environment. It allows system administrators to enforce policies through the Execution Control List (ECL), which defines rules for permitting or denying the execution of container images. However, Singularity versions below 3.6.0 suffer from an insecure ECL implementation.
Vulnerability Detail
The ECL in Singularity 3.x versions below 3.6.0 has two critical issues. Firstly, it does not validate the integrity of container images when enforcing the ECL policy. Secondly, it compares the required fingerprint against the signature object descriptor(s) in the SIF file, rather than using cryptographically validated signatures. This allows a malicious user to bypass the ECL and execute arbitrary payloads, even without access to the private key associated with the configured fingerprints. The impact of this vulnerability is significant as it undermines the security measures provided by the ECL.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/sylabs/singularity@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.0
This is the first release that contains the fix.
go get github.com/sylabs/singularity@v3.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no workaround available for this vulnerability if the ECL functionality is required. Users are advised to upgrade to Singularity 3.6.0 or later.
Conclusion
The insecure Execution Control List (ECL) implementation in Singularity versions below 3.6.0 allows for bypassing the ECL and executing arbitrary payloads. To mitigate this vulnerability, users should upgrade to Singularity 3.6.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/sylabs/singularity →
FAQ
The ECL is a feature in Singularity that enables system administrators to define policies for permitting or denying the execution of container images based on specified signatures.
This vulnerability allows a malicious user to bypass the ECL and execute arbitrary payloads, even without access to the private key associated with the configured fingerprints. It undermines the security measures provided by the ECL.
The recommended solution is to upgrade to Singularity 3.6.0 or later, which includes fixes for the insecure ECL implementation.
No, Singularity 3.6.0 uses a new signature format that is incompatible with previous versions. Containers signed with Singularity 3.6.0 cannot be verified by versions prior to 3.6.0.
No, there is no workaround available if the ECL functionality is required. Upgrading to Singularity 3.6.0 or later is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sylabs/singularity.
