3.7.3 CHANGELOG and INSTALL changes

CHANGELOG.md

@@ -9,6 +9,18 @@ _With the release of `v3.0.0`, we're introducing a new changelog format in an at
 
 _The old changelog can be found in the `release-2.6` branch_
 
+# v3.7.3 - [2021-04-06]
+
+## Security Related Fixes
+
+  - [CVE-2021-29136](https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v):
+   A dependency used by Singularity to extract docker/OCI image layers
+   can be tricked into modifying host files by creating a malicious
+   layer that has a symlink with the name "." (or "/"), when running
+   as root. This vulnerability affects a `singularity build` or
+   `singularity pull` as root, from a docker or OCI source.
+
+
 # v3.7.2 - [2021-03-09]
 
 ## Bug Fixes

INSTALL.md

@@ -133,7 +133,7 @@ as shown above.  Then download the latest
 and use it to install the RPM like this: 
 
 ```
-$ export VERSION=3.7.2  # this is the singularity version, change as you need
+$ export VERSION=3.7.3  # this is the singularity version, change as you need
 
 $ wget https://github.com/sylabs/singularity/releases/download/v${VERSION}/singularity-${VERSION}.tar.gz && \
     rpmbuild -tb singularity-${VERSION}.tar.gz && \
@@ -149,7 +149,7 @@ tarball and use it to install Singularity:
 $ cd $GOPATH/src/github.com/sylabs/singularity && \
   ./mconfig && \
   make -C builddir rpm && \
-  sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/singularity-3.7.2*.x86_64.rpm # or whatever version you built
+  sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/singularity-3.7.3*.x86_64.rpm # or whatever version you built
 ```
 
 To build an rpm with an alternative install prefix set RPMPREFIX on the