{"affected":[{"ecosystem_specific":{"binaries":[{"singularity":"3.8.5-bp153.2.10.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP3","name":"singularity","purl":"pkg:rpm/suse/singularity&distro=SUSE%20Package%20Hub%2015%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.8.5-bp153.2.10.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"singularity":"3.8.5-bp153.2.10.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.3","name":"singularity","purl":"pkg:rpm/opensuse/singularity&distro=openSUSE%20Leap%2015.3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.8.5-bp153.2.10.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for singularity fixes the following issues:\n\nUpdate to 3.8.5:\n\n- CVE-2021-41190: Fixed OCI manifest and index parsing confusion (boo#1193273).\n- Building Singularity from source requires go greater or equal 1.16. We now aim\n  to support the two most recent stable versions of Go. This\n  corresponds to the Go Release Maintenance Policy\n- Sourcing a script based on PATH is now permitted, fixing a\n  regression introduced in 3.6.0.\n- Environment variables in container definition files are\n  properly scoped, fixing a regression introduced in 3.8.0.\n- Fix the oras contexts to avoid hangs upon failed pushes to \n  Harbor registry.\n","id":"openSUSE-SU-2021:1525-1","modified":"2021-12-04T13:06:13Z","published":"2021-12-04T13:06:13Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L3AGIEOXZIUUEYYMWKJCJCQI7V235UTR/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1193273"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-41190"}],"related":["CVE-2021-41190"],"summary":"Security update for singularity","upstream":["CVE-2021-41190"]}