Release 3.8

CHANGELOG.md

@@ -10,7 +10,7 @@ _With the release of `v3.0.0`, we're introducing a new changelog format in an at
 _The old changelog can be found in the `release-2.6` branch_
 
 
-# v3.8.0 - [2021-05-21]
+# v3.8.0-rc.2 Release Candidate - [2021-05-26]
 
 > :warning: Go module was renamed from `github.com/sylabs/singularity` to `github.com/hpcng/singularity`
 
@@ -54,6 +54,20 @@ of `make test` for ease of use:
     and `E2E_DOCKER_PASSWORD` environment variables.
 
 
+# v3.7.4 - [2021-05-26]
+
+## Security Related Fixes
+
+  - [CVE-2021-32635](https://github.com/hpcng/singularity/security/advisories/GHSA-jq42-hfch-42f3):
+    Due to incorrect use of a default URL, singularity action commands
+    (run/shell/exec) specifying a container using a library:// URI will
+    always attempt to retrieve the container from the default remote
+    endpoint (cloud.sylabs.io) rather than the configured remote
+    endpoint.  An attacker may be able to push a malicious container to
+    the default remote endpoint with a URI that is identical to the URI
+    used by a victim with a non-default remote endpoint, thus executing
+    the malicious container.
+
 # v3.7.3 - [2021-04-06]
 
 ## Security Related Fixes

cmd/internal/cli/actions.go

@@ -20,7 +20,6 @@ import (
 	"github.com/hpcng/singularity/internal/pkg/client/oci"
 	"github.com/hpcng/singularity/internal/pkg/client/oras"
 	"github.com/hpcng/singularity/internal/pkg/client/shub"
-	"github.com/hpcng/singularity/internal/pkg/remote/endpoint"
 	"github.com/hpcng/singularity/internal/pkg/util/uri"
 	"github.com/hpcng/singularity/pkg/sylog"
 	"github.com/spf13/cobra"
@@ -80,11 +79,10 @@ func handleLibrary(ctx context.Context, imgCache *cache.Handle, pullFrom string)
 		return "", err
 	}
 
+	// Default "" = use current remote endpoint
 	var libraryURI string
 	if r.Host != "" {
 		libraryURI = "https://" + r.Host
-	} else {
-		libraryURI = endpoint.SCSDefaultLibraryURI
 	}
 
 	c, err := getLibraryClientConfig(libraryURI)

e2e/actions/actions.go

@@ -2198,6 +2198,8 @@ func E2ETests(env e2e.TestEnv) testhelper.Tests {
 		env: env,
 	}
 
+	np := testhelper.NoParallel
+
 	return testhelper.Tests{
 		"action URI":            c.RunFromURI,          // action_URI
 		"exec":                  c.actionExec,          // singularity exec
@@ -2230,5 +2232,6 @@ func E2ETests(env e2e.TestEnv) testhelper.Tests {
 		"bind image":            c.bindImage,           // test bind image
 		"umask":                 c.actionUmask,         // test umask propagation
 		"no-mount":              c.actionNoMount,       // test --no-mount
+		"invalidRemote":         np(c.invalidRemote),   // GHSA-5mv9-q7fq-9394
 	}
 }

e2e/actions/regressions.go

@@ -616,3 +616,71 @@ func (c actionTests) issue5690(t *testing.T) {
 		e2e.ExpectExit(0),
 	)
 }
+
+// If an invalid remote is set, we should not pull a container from the default
+// library.
+// Github Security Advisories:
+// GHSA-jq42-hfch-42f3 (hpcng)
+// GHSA-5mv9-q7fq-9394 (sylabs)
+func (c actionTests) invalidRemote(t *testing.T) {
+	testEndpoint := "invalid"
+	testEndpointURI := "https://cloud.example.com"
+	testImage := "library://alpine"
+
+	// Exec library image from the default remote... ensure it succeeds
+	argv := []string{testImage, "/bin/true"}
+	c.env.RunSingularity(
+		t,
+		e2e.AsSubtest("exec default"),
+		e2e.WithProfile(e2e.UserProfile),
+		e2e.WithCommand("exec"),
+		e2e.WithArgs(argv...),
+		e2e.ExpectExit(0),
+	)
+
+	// Add another endpoint
+	argv = []string{"add", "--no-login", testEndpoint, testEndpointURI}
+	c.env.RunSingularity(
+		t,
+		e2e.AsSubtest("remote add"),
+		e2e.WithProfile(e2e.UserProfile),
+		e2e.WithCommand("remote"),
+		e2e.WithArgs(argv...),
+		e2e.ExpectExit(0),
+	)
+	// Remove test remote when we are done here
+	defer func(t *testing.T) {
+		argv := []string{"remove", testEndpoint}
+		c.env.RunSingularity(
+			t,
+			e2e.AsSubtest("remote remove"),
+			e2e.WithProfile(e2e.UserProfile),
+			e2e.WithCommand("remote"),
+			e2e.WithArgs(argv...),
+			e2e.ExpectExit(0),
+		)
+	}(t)
+
+	// Set as default
+	argv = []string{"use", testEndpoint}
+	c.env.RunSingularity(
+		t,
+		e2e.AsSubtest("remote use"),
+		e2e.WithProfile(e2e.UserProfile),
+		e2e.WithCommand("remote"),
+		e2e.WithArgs(argv...),
+		e2e.ExpectExit(0),
+	)
+
+	// Exec library image from the invalid remote, should fail
+	argv = []string{testImage, "/bin/true"}
+	c.env.RunSingularity(
+		t,
+		e2e.AsSubtest("exec invalid"),
+		e2e.WithProfile(e2e.UserProfile),
+		e2e.WithCommand("exec"),
+		e2e.WithArgs(argv...),
+		e2e.ExpectExit(255),
+	)
+
+}