Skip to content

Commit

Permalink
Merge pull request #56 from dtrudg/3.7.4-changelog
Browse files Browse the repository at this point in the history
Cherry-pick 3.7.4 changelog from hpcng/singularity
  • Loading branch information
dtrudg authored May 26, 2021
2 parents d52ae9d + 577f739 commit a29667c
Showing 1 changed file with 14 additions and 0 deletions.
14 changes: 14 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,20 @@ _With the release of `v3.0.0`, we're introducing a new changelog format in an at

_The old changelog can be found in the `release-2.6` branch_

# v3.7.4 - [2021-05-26]

## Security Related Fixes

- [CVE-2021-32635](https://github.com/hpcng/singularity/security/advisories/GHSA-jq42-hfch-42f3):
Due to incorrect use of a default URL, singularity action commands
(run/shell/exec) specifying a container using a library:// URI will
always attempt to retrieve the container from the default remote
endpoint (cloud.sylabs.io) rather than the configured remote
endpoint. An attacker may be able to push a malicious container to
the default remote endpoint with a URI that is identical to the URI
used by a victim with a non-default remote endpoint, thus executing
the malicious container.

# v3.7.3 - [2021-04-06]

## Security Related Fixes
Expand Down

0 comments on commit a29667c

Please sign in to comment.