—

GO-2022-1045

Improper validation of signature hash algorithms in github.com/sylabs/sif/v2

Quick fix

GO-2022-1045 — github.com/sylabs/sif/v2: upgrade to the fixed version with the command below.

go get github.com/sylabs/sif/v2@v2.8.1

Details

The Singularity Image Format (SIF) reference implementation does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/sylabs/sif/v2

Introduced in: 0Fixed in: 2.8.1

Fixgo get github.com/sylabs/sif/v2@v2.8.1

References

https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8[ADVISORY]
https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa[FIX]