TI-2019-08462 Aliases CVE-2019-11328 GHSA-557g-r22w-9wvx

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with…

MEDIUM 42CWE-732Published 2019-05-14 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.

Why it matters now

EPSS 0.02088 81st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed github.com/sylabs/singularity (Go): 3.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	github.com/sylabs/singularity (Go)	3.1.0 to before 3.2.0	3.2.0	Patch available	GHSA-557g-r22w-9wvx

— Vendor— Affected all versions Fixed in — No fix listed CNA
github.com/sylabs/singularity (Go) Vendor— Affected 3.1.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-557g-r22w-9wvx

CPE configurations NVD · 10

CPE	Versions	Role	Vendor
cpe:2.3:a:sylabs:singularity::::::::	3.1.0 to before 3.2.0	Vulnerable	sylabs
cpe:2.3:a:sylabs:singularity:3.2.0:-::::::	3.2.0	Vulnerable	sylabs
cpe:2.3:a:sylabs:singularity:3.2.0:rc1::::::	3.2.0 rc1	Vulnerable	sylabs
cpe:2.3:a:sylabs:singularity:3.2.0:rc2::::::	3.2.0 rc2	Vulnerable	sylabs
cpe:2.3:o:fedoraproject:fedora:28:::::::*	28	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:29:::::::*	29	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:30:::::::*	30	Vulnerable	Fedoraproject
cpe:2.3:o:opensuse:backports:sle-15:-::::::	sle-15	Vulnerable	openSUSE
cpe:2.3:o:opensuse:backports:sle-15:sp1::::::	sle-15 sp1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE

cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.2.0 Vulnerable ·sylabs
cpe:2.3:a:sylabs:singularity:3.2.0:-:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·sylabs
cpe:2.3:a:sylabs:singularity:3.2.0:rc1:*:*:*:*:*:* Versions 3.2.0 rc1 Vulnerable ·sylabs
cpe:2.3:a:sylabs:singularity:3.2.0:rc2:*:*:*:*:*:* Versions 3.2.0 rc2 Vulnerable ·sylabs
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
cpe:2.3:o:opensuse:backports:sle-15:-:*:*:*:*:*:* Versions sle-15 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:backports:sle-15:sp1:*:*:*:*:*:* Versions sle-15 sp1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

Fix · GHSA-557g-r22w-9wvx github.com/sylabs/singularity (Go) Fixed in 3.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2019-11328
2026-10-03 Alias added: GHSA-557g-r22w-9wvx

References

Exploit 1

[oss-security] 20190516 Singularity 3.1.0: CVE-2019-11328: namespace privilege escalation and arbitrary file corruption

Advisory 6

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences