CVE-2021-32635: 
Homebrew vulnerability analysis and mitigation

Singularity is an open source container platform affected by a vulnerability (CVE-2021-32635) discovered in versions 3.7.2 and 3.7.3. The vulnerability was disclosed on May 28, 2021, and involves incorrect handling of default URLs in container action commands. The issue affects the core functionality of Singularity when using library:// URIs for container operations (NVD, GitHub Advisory).

The vulnerability stems from Singularity's action commands (run/shell/exec) incorrectly using the default remote endpoint (cloud.sylabs.io) instead of the configured remote endpoint when specifying containers with library:// URIs. The issue has been assigned a CVSS v3.1 Base Score of 6.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. Other commands such as pull/push are not affected and properly respect the configured remote endpoint (GitHub Advisory).

An attacker could exploit this vulnerability by pushing a malicious container to the default remote endpoint (cloud.sylabs.io) with a URI matching one used by a victim who has configured a non-default remote endpoint. When the victim executes action commands against this URI, they would unknowingly run the attacker's malicious container instead of their intended container (Gentoo Security, GitHub Advisory).

The vulnerability requires no special privileges to exploit but does require user interaction. The attack vector is network-based, with low attack complexity. An attacker must be able to push containers to the default remote endpoint to successfully exploit this vulnerability (GitHub Advisory).

The vulnerability was patched in Singularity version 3.7.4. Two workarounds exist for users unable to upgrade: 1) Only interact with the default remote endpoint, or 2) Configure an execution control list to restrict execution to containers signed with specific secure keys. Users are strongly advised to upgrade to version 3.7.4 or later for complete protection (GitHub Release).