openSUSE Security Update: Security update for singularity
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:2288-1
Rating: moderate
References: #1125369 #1128598
Cross-References: CVE-2019-11328
Affected Products:
openSUSE Backports SLE-15-SP1
openSUSE Backports SLE-15
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for singularity fixes the following issues:

singularity was updated to version 3.4.1:

This point release addresses the following issues:

– Fixes an issue where a PID namespace was always being used
– Fixes compilation on non 64-bit architectures
– Allows fakeroot builds for zypper, pacstrap, and debootstrap
– Correctly detects seccomp on OpenSUSE
– Honors GO_MODFLAGS properly in the mconfig generated makefile
– Passes the Mac hostname to the VM in MacOS Singularity builds
– Handles temporary EAGAIN failures when setting up loop devices on recent
kernels.

New version 3.4.0. Many changes since 3.2.1, for the full changelog please
read CHANGELOG.md

Update to version 3.2.1:

This point release fixes the following bugs:

– Allows users to join instances with non-suid workflow
– Removes false warning when seccomp is disabled on the host
– Fixes an issue in the terminal when piping output to commands
– Binds NVIDIA persistenced socket when `–nv` is invoked

Improve integration with SUSE Products: add support to create Singularity
images with SLE.

* Newer SUSE versions use a different path for the RPM database.
* When the installation succeeds by an installation scriptlet fails zypper
returns error code 107. Don’t treat this as an error.
* In order to specify a repository GPG key, add support for multi line
variables.
* In order to specify a list of additional repos, add support to ‘indexed’
variables.
* Improve handling of SUSE repositires:

– For SLE, use SUSEConnect to get all product repos.
– Allow to specify a repository GPG key.
– Allow to specify additional installation repositories.

– Add group ‘singularity’, fix ownerships.

Updated to singularity v3.2.0

* CVE-2019-11328: Instance files are now stored in user’s home directory
for privacy and many checks have been added to ensure that a user can’t
manipulate files to change `starter-suid` behavior when instances are
joined (many thanks to Matthias Gerstner from the SUSE security team for
finding and securely reporting this vulnerability) (boo#1128598)

* New features / functionalities

– Introduced a new basic framework for creating and managing plugins
– Added the ability to create containers through multi-stage builds
– Created the concept of a Sylabs Cloud “remote” endpoint and added the
ability for users and admins to set them through CLI and conf files
– Added caching for images from Singularity Hub
– Made it possible to compile Singularity outside of `$GOPATH`
– Added a json partition to SIF files for OCI configuration when
building from an OCI source
– Full integration with Singularity desktop for MacOS code base

* New Commands

– Introduced the `plugin` command group for creating and managing
plugins.

* Introduced the `remote` command group to support management of
Singularity endpoints.
* Added to the `key` command group to improve PGP key management.
* Added the `Stage: <name>` keyword to the definition file header and the
`from <stage name>` option/argument pair to the `%files` section to
support multistage builds
* Deprecated / removed commands

– The `–token/-t` option has been deprecated in favor of the
`singularity remote` command group

* Changed defaults / behaviors

– Ask to confirm password on a newly generated PGP key
– Prompt to push a key to the KeyStore when generated
– Refuse to push an unsigned container unless overridden with
`–allow-unauthenticated/-U` option
– Warn and prompt when pulling an unsigned container without the
`–allow-unauthenticated/-U` option For more information check:
https://github.com/sylabs/singularity/blob/release-3.2/CHANGELOG.md

Updated to singularity v3.1.1:

* New Commands

– New hidden `buildcfg` command to display compile-time parameters
– Added support for `LDFLAGS`, `CFLAGS`, `CGO_` variables in build system
– Added `–nocolor` flag to Singularity client to disable color in
logging

* Removed Commands

– `singularity capability <add/drop> –desc` has been removed
– `singularity capability list <–all/–group/–user>` flags have all
been removed

* New features / functionalities
– The `–builder` flag to the `build` command implicitly sets `–remote`
– Repeated binds no longer cause Singularity to exit and fail, just warn
instead
– Corrected typos and improved docstrings throughout
– Removed warning when CWD does not exist on the host system
– Added support to spec file for RPM building on SLES 11

Update to singularity 3.1.0 what is reimplementaion in go so this is a
complete new build and just reusing the changelog entries, following build
differences were made to the upstream spec file

* build position independent executable
* build stripped executable

– Change from /var/singularity to /var/lib/singularity
– Fix warning on bash-completion file about non-executible script.

– Add bash completions directory to file list for suse_version < 1500 to
keep the build checker happy.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Backports SLE-15-SP1:

zypper in -t patch openSUSE-2019-2288=1

– openSUSE Backports SLE-15:

zypper in -t patch openSUSE-2019-2288=1

Package List:

– openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):

singularity-3.4.1-bp151.3.3.1
singularity-debuginfo-3.4.1-bp151.3.3.1

– openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64):

singularity-3.4.1-bp150.2.10.1

References:

https://www.suse.com/security/cve/CVE-2019-11328.html
https://bugzilla.suse.com/1125369
https://bugzilla.suse.com/1128598

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org