CVE-2022-23538

CVE-2022-23538 affects the sylabs/scs-library-client, a Go client for the Singularity Container Services (SCS) Container Library Service. It involves the improper leakage of HTTP Authorization headers to a third-party S3 backing storage provider during specific multi-part concurrent downloads, primarily impacting Singularity Enterprise 1.x installations. With a CVSS score of 7.6 HIGH, this vulnerability allows an attacker with access to the S3 service to extract user credentials, leading to potential impersonation and high confidentiality impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.