SingularityCE 4.1.1

[dtrudg]

SingularityCE 4.1.1 is a patch release in the 4.1 series, including security and bug fixes.

Security Related Fixes

• Update github.com/moby/buildkit dependency, used for --oci Dockerfile builds, addressing the following upstream CVEs:
  • CVE-2024-23650 Possible panic when incorrect parameters sent from frontend
  • CVE-2024-23651 Possible race condition with accessing subpaths from cache mounts.
  • CVE-2024-23652 Possible host system access from mount stub cleaner.
  • CVE-2024-23653 Interactive containers API does not validate entitlements check.

Note also that in OCI-Mode, SingularityCE may call out to runc versions vulnerable to CVE-2024-21626. runc is not bundled with SingularityCE, and should be updated via your Linux distribution's package manager, or manually.

Bug Fixes

• Workaround segfault in crun v1.11+ when no resource limits are specified. Segfault with run --systemd-cgroup but no linux.resources in config.json (v1.11+) containers/crun#1402

Thanks / Reporting Bugs

Thanks to our contributors for code, feedback and, testing efforts!

As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new

If you think that you've discovered a security vulnerability please report it to: [email protected]

Have fun!

Downloads

Source Code

Please use the singularity-ce-4.1.1.tar.gz download below to obtain and install SingularityCE 4.1.1. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.

Packages

RPM / DEB packages are provided for:

• Ubuntu 20.04 (focal)
• Ubuntu 22.04 (jammy)
• RHEL/CentOS 7 (el7)
• RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
• RHEL/CentOS/AlmaLinux/Rocky 9 (el9)

These packages were built with Go 1.21.6

---

This discussion was created from the release SingularityCE 4.1.1.