CVE-2019-11328 - CVE House
Back to Database
Status published High CVE-2019-11328

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a...

Vulnerability Description

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11328

Credits & Attribution

No credits recorded in the NVD database.

References

More from sylabs

View All →
CVE-2025-64750
Singluarity ineffectively applies of selinux / apparmor LSM process labels
Medium 4.5
CVE-2022-39237
Digital Signature Hash Algorithms Not Validated in sylabs/sif
Medium 6.3
CVE-2022-23538
User credentials leaked to third-party service via HTTP redirect in scs-library-client
Medium 5.2
CVE-2021-33622
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has...
Critical 9.8
CVE-2021-33027
Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a...
Critical 9.8

Affected Vendor

Affected Software

singularity, fedora, backports, leap
Vulnerable Versions:
3.1.0, 3.2.0, 28, 29, 30, sle-15, 15.1

Timeline

Official Publish: May 14th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.