CVE-2020-13846: Verify All Returns Success Despite Validation Failures in Singularity
Summary
CVE-2020-13846: "Verify All" Returns Success Despite Validation Failures in Singularity. Affects github.com/sylabs/singularity versions >= 3.5.0, < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Singularity is an open-source container platform designed to support scientific and high-performance computing workflows. It allows users to create and run containers that encapsulate their applications and dependencies. Singularity provides features such as container verification to ensure the integrity and security of the containers.
Vulnerability Detail
The --all / -a option in Singularity's verify command does not properly handle validation failures. When verifying a container using this option, even if some objects in the container are not signed or cannot be verified, Singularity returns a success status and a message indicating that the container is verified. However, the unsigned or modified objects are reported as warnings in the log messages. This vulnerability can be exploited to introduce malicious behavior into containers that are considered verified.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/sylabs/singularity@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.0
This is the first release that contains the fix.
go get github.com/sylabs/singularity@v3.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Singularity's verify command can lead to running containers with unsigned or modified objects that may introduce malicious behavior. It is recommended to upgrade to Singularity version 3.6.0 or later to fix this vulnerability. If upgrading is not possible, caution should be exercised when relying on the return code of the verify command.
See every vulnerability recorded for github.com/sylabs/singularity →
FAQ
Singularity is an open-source container platform designed for scientific and high-performance computing workflows. It allows users to create and run containers that encapsulate their applications and dependencies.
The verify command in Singularity is used to verify the integrity and authenticity of a container. It checks if the container and its objects are signed and have not been modified since signing.
The impact of this vulnerability is that the --all / -a option in the verify command returns a success status even when some objects in the container are not signed or cannot be verified. This can lead to running containers with unsigned or modified objects that may introduce malicious behavior.
To fix this vulnerability, it is recommended to upgrade to Singularity version 3.6.0 or later. This version includes a new implementation of sign/verify that addresses the issue.
If you are unable to upgrade to Singularity 3.6.0, it is advised not to rely on the return code of singularity verify --all / -a as an indicator of trust in a container.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sylabs/singularity.
