Impact

The github.com/sylabs/sif/v2/pkg/integrity package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures.

Patches

A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade.

The patch is commit 07fb860

Workarounds

Users may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

References

• CVE-2004-2761
• CVE-2005-4900

For more information

If you have any questions or comments about this advisory:

• Open an issue in github.com/sylabs/sif
• Email us at security@sylabs.io