openSUSE Security Update: Security update for singularity
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:2288-1
Rating:             moderate
References:         #1125369 #1128598 
Cross-References:   CVE-2019-11328
Affected Products:
                    openSUSE Backports SLE-15-SP1
                    openSUSE Backports SLE-15
______________________________________________________________________________

   An update that solves one vulnerability and has one errata
   is now available.

Description:

   This update for singularity fixes the following issues:

   singularity was updated to version 3.4.1:

   This point release addresses the following issues:

   - Fixes an issue where a PID namespace was always being used
   - Fixes compilation on non 64-bit architectures
   - Allows fakeroot builds for zypper, pacstrap, and debootstrap
   - Correctly detects seccomp on OpenSUSE
   - Honors GO_MODFLAGS properly in the mconfig generated makefile
   - Passes the Mac hostname to the VM in MacOS Singularity builds
   - Handles temporary EAGAIN failures when setting up loop devices on recent
     kernels.

   New version 3.4.0. Many changes since 3.2.1, for the full changelog please
   read CHANGELOG.md

   Update to version 3.2.1:

   This point release fixes the following bugs:

   - Allows users to join instances with non-suid workflow
   - Removes false warning when seccomp is disabled on the host
   - Fixes an issue in the terminal when piping output to commands
   - Binds NVIDIA persistenced socket when `--nv` is invoked

   Improve integration with SUSE Products: add support to create Singularity
   images with SLE.

   * Newer SUSE versions use a different path for the RPM database.
   * When the installation succeeds by an installation scriptlet fails zypper
     returns error code 107. Don't treat this as an error.
   * In order to specify a repository GPG key, add support for multi line
     variables.
   * In order to specify a list of additional repos, add support to
 'indexed'
     variables.
   * Improve handling of SUSE repositires:

     - For SLE, use SUSEConnect to get all product repos.
     - Allow to specify a repository GPG key.
     - Allow to specify additional installation repositories.

   - Add group 'singularity', fix ownerships.

   Updated to singularity v3.2.0

   * CVE-2019-11328: Instance files are now stored in user's home directory
     for privacy and many checks have been added to ensure that a user
 can't
     manipulate files to change `starter-suid` behavior when instances are
     joined (many thanks to Matthias Gerstner from the SUSE security team for
     finding and securely reporting this vulnerability) (boo#1128598)

   * New features / functionalities

     - Introduced a new basic framework for creating and managing plugins
     - Added the ability to create containers through multi-stage builds
     - Created the concept of a Sylabs Cloud "remote" endpoint and
 added the
       ability for users and admins to set them through CLI and conf files
     - Added caching for images from Singularity Hub
     - Made it possible to compile Singularity outside of `$GOPATH`
     - Added a json partition to SIF files for OCI configuration when
       building from an OCI source
     - Full integration with Singularity desktop for MacOS code base

   * New Commands

     - Introduced the `plugin` command group for creating and managing
       plugins.

   * Introduced the `remote` command group to support management of
     Singularity endpoints.
   * Added to the `key` command group to improve PGP key management.
   * Added the `Stage: <name>` keyword to the definition file header and
 the
     `from <stage name>` option/argument pair to the `%files` section to
     support multistage builds
   * Deprecated / removed commands

     - The `--token/-t` option has been deprecated in favor of the
       `singularity remote` command group

   * Changed defaults / behaviors

     - Ask to confirm password on a newly generated PGP key
     - Prompt to push a key to the KeyStore when generated
     - Refuse to push an unsigned container unless overridden with
       `--allow-unauthenticated/-U` option
     - Warn and prompt when pulling an unsigned container without the
       `--allow-unauthenticated/-U` option For more information check:
       https://github.com/sylabs/singularity/blob/release-3.2/CHANGELOG.md

   Updated to singularity v3.1.1:

   * New Commands

     - New hidden `buildcfg` command to display compile-time parameters
     - Added support for `LDFLAGS`, `CFLAGS`, `CGO_` variables in build system
     - Added `--nocolor` flag to Singularity client to disable color in
       logging

   * Removed Commands

     - `singularity capability <add/drop> --desc` has been removed
     - `singularity capability list <--all/--group/--user>` flags have
 all
       been removed

   * New features / functionalities
     - The `--builder` flag to the `build` command implicitly sets `--remote`
     - Repeated binds no longer cause Singularity to exit and fail, just warn
       instead
     - Corrected typos and improved docstrings throughout
     - Removed warning when CWD does not exist on the host system
     - Added support to spec file for RPM building on SLES 11

   Update to singularity 3.1.0 what is reimplementaion in go so this is a
   complete new build and just reusing the changelog entries, following build
   differences were made to the upstream spec file

   * build position independent executable
   * build stripped executable

   - Change from /var/singularity to /var/lib/singularity
   - Fix warning on bash-completion file about non-executible script.

   - Add bash completions directory to file list for suse_version < 1500 to
     keep the build checker happy.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended
 installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP1:

      zypper in -t patch openSUSE-2019-2288=1

   - openSUSE Backports SLE-15:

      zypper in -t patch openSUSE-2019-2288=1



Package List:

   - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64):

      singularity-3.4.1-bp151.3.3.1
      singularity-debuginfo-3.4.1-bp151.3.3.1

   - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64):

      singularity-3.4.1-bp150.2.10.1


References:

   https://www.suse.com/security/cve/CVE-2019-11328.html
   https://bugzilla.suse.com/1125369
   https://bugzilla.suse.com/1128598

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org