SingularityCE 4.4.2

[dtrudg]

Security Related Fixes

• Fix for CVE-2026-47215 / GHSA-wqcr-7rf3-f64m Incorrect path matching for 'limit container paths' directive

Changed Defaults / Behaviours

Although SingularityCE does not aim to contain execution / prevent host modification when started as the host root user, the following changes have been adopted to permit finer control over the use of external binaries, with a modified default search path when singularity is run as the host root user:

• When started as host root, external binaries (except those with explicit configuration entries) are now found using the root search path in singularity.conf. By default this excludes searching the environment $PATH. Add $PATH: to the start of root search path in singularity.conf to restore previous behavior.
• When started as non-root / fake root, external binaries (except those with explicit configuration entires) are now found using the user search path in singularity.conf. By default this includes $PATH, so there is no effective behaviour change vs previous versions.

Thank you to @KoseceMehmet for suggesting this change.

Thanks / Reporting Bugs

Thanks to our contributors for code, feedback and, testing efforts!

As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new

If you think that you've discovered a security vulnerability please report it to: security@sylabs.io

Have fun!

Downloads

Source Code

Please use the singularity-ce-4.4.2.tar.gz download below to obtain and install SingularityCE 4.4.2. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.

Packages

RPM / DEB packages are provided for:

• Ubuntu 22.04 (jammy)
• Ubuntu 24.04 (noble)
• RHEL/CentOS/AlmaLinux/Rocky 8 (el8)
• RHEL/CentOS/AlmaLinux/Rocky 9 (el9)
• RHEL/CentOS/AlmaLinux/Rocky 10 (el10)

These packages were built with Go 1.26.4

Upload-time immutable digests are now provided for release downloads by GitHub. A separate sha256sums file will no longer be provided.

---

This discussion was created from the release SingularityCE 4.4.2.