Every CVE Search/ Get API key

CVE-2025-65105

Apptainer ineffective application of selinux and apparmor --security options

4.5 MediumFix available

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.25%Up 0.2 points since Dec 3, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.5

Apptainer ineffective application of selinux and apparmor --security options

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
CVE-2025-65105
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-61, CWE-706
Updated
2026-11-02
EUVDEUVD-2025-200292 4.5

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
EUVD-2025-200292
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-j3rw-fx6g-q46j 4.5

Apptainer ineffectively applies selinux and apparmor --security options

Impact

In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version.

In addition, a bug in the detection of selinux support in Apptainer's suid mode means that --security selinux:<label> flags may not be applied, even in the absence of an attack. In that case a warning message is emitted indicating that selinux is unavailable, but the warning may be may be overlooked, mis-interpreted, or not seen when apptainer is run from a script or other tool. Failure to apply requested restrictions should result in a fatal error rather than just a warning message.

Patches

Ineffective write of selinux process labels is addressed via an update to the containers/selinux dependency in https://github.com/apptainer/apptainer/pull/3226. That update brings in the upstream fix for https://github.com/advisories/GHSA-cgrx-mc8f-2prm which was for a different but related vulnerability.

Ineffective write of apparmor process profiles is addressed in commit 4313b42.

Failure to detect apparmor / selinux support, when --security flags are provided, is made an error rather than a warning in commit 82f1790.

Workarounds

There are no known workarounds, other than to define system-wide apparmor / selinux policy for Apptainer itself. This would apply to all containers, not just those run with the --security flags, and could impact the operation of Apptainer itself.

References

Thanks to Sylabs for finding this issue, fixing it in https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 which was easy to import into Apptainer, and disclosing it early to the Apptainer project for a coordinated release.

The related upstream runc disclosure which inspired the investigation is https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm.

Record
GHSA-j3rw-fx6g-q46j
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-61, CWE-706
Updated
2026-11-02
NVD 4.5

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
CVE-2025-65105
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-61, CWE-706
Updated
2026-11-02
OSVALPINE-CVE-2025-65105 5.3

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
ALPINE-CVE-2025-65105
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-03
OSV 4.5

Apptainer ineffective application of selinux and apparmor --security options

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
CVE-2025-65105
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-61, CWE-706
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2025-65105 5.3

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
DEBIAN-CVE-2025-65105
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGHSA-j3rw-fx6g-q46j 4.5

Apptainer ineffectively applies selinux and apparmor --security options

Impact

In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version.

In addition, a bug in the detection of selinux support in Apptainer's suid mode means that --security selinux:<label> flags may not be applied, even in the absence of an attack. In that case a warning message is emitted indicating that selinux is unavailable, but the warning may be may be overlooked, mis-interpreted, or not seen when apptainer is run from a script or other tool. Failure to apply requested restrictions should result in a fatal error rather than just a warning message.

Patches

Ineffective write of selinux process labels is addressed via an update to the containers/selinux dependency in https://github.com/apptainer/apptainer/pull/3226. That update brings in the upstream fix for https://github.com/advisories/GHSA-cgrx-mc8f-2prm which was for a different but related vulnerability.

Ineffective write of apparmor process profiles is addressed in commit 4313b42.

Failure to detect apparmor / selinux support, when --security flags are provided, is made an error rather than a warning in commit 82f1790.

Workarounds

There are no known workarounds, other than to define system-wide apparmor / selinux policy for Apptainer itself. This would apply to all containers, not just those run with the --security flags, and could impact the operation of Apptainer itself.

References

Thanks to Sylabs for finding this issue, fixing it in https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 which was easy to import into Apptainer, and disclosing it early to the Apptainer project for a coordinated release.

The related upstream runc disclosure which inspired the investigation is https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm.

Record
GHSA-j3rw-fx6g-q46j
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-61, CWE-706
Updated
2026-11-02
OSVUBUNTU-CVE-2025-65105 4.5

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Record
UBUNTU-CVE-2025-65105
CVSS 3.1
4.5 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGO-2025-4176 No score

Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer

Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer

Record
GO-2025-4176
Updated
2026-11-02
OSVopenSUSE-SU-2026:10013-1 No score

apptainer-1.4.5-1.1 on GA media

These are all security issues fixed in the apptainer-1.4.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10013-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20730-1 No score

Security update for apptainer

This update for apptainer fixes the following issues:

Changes in apptainer:

  • Fix CVE-2026-34986 (bsc#1262956) * github.com/go-jose/go-jose/[email protected] CVE-2026-33186 GO-2026-4762 (bsc#1260311) * google.golang.org/[email protected] CVE-2026-24137 GO-2026-4358 (bsc#1264177) * github.com/sigstore/[email protected] Fix fallout: github.com/moby/[email protected] github.com/containers/image/v5=github.com/containers/image/[email protected]

  • Fix HTML parser misimplementation of a part of the HTML specification for table related tags (CVE-2025-58190, GO-2026-4441, bsc#1258048).

  • Fix issue where the HTML parser takes a very long time or even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).

  • Update ot 1.4.5

    • Fix for moderate severity GO-2025-4176 / CVE-2025-65105 / GHSA-j3rw-fx6g-q46j (bsc#1255462): Ineffective application of selinux / apparmor --security option. Updates of a few dependent go libraries for related security fixes.
    • Other fix Run FUSE processes in a separate process group. This detaches them from the main process so they don't receive signals such as interrupts sent to a terminal there. This was not a problem with interactive shells because they start their own group, but was a problem with some programs with interactive Read/Eval/Print/Loops such as python. An interrupt there would kill the FUSE processes.

  • From 1.4.4

    • By applying patches to the bundled fuse2fs, allow again the possibility of using a non-writable ext3 image file as an overlay. Fixes regression introduced in 1.4.3.
    • If an overlay or bound data image is asked to be mounted writable but the user has no write access to the image, show a warning message instead of silently switching to readonly.
    • Avoid a fatal error when starting fakeroot from suid mode while in an NFS directory.
    • Fix 32-bit builds which were accidentally broken by a library upgrade that was done for a minor security issue.

  • Fix CVEs:

    • GO-2025-4135 - CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent.
    • GO-2025-4134 - CVE-2025-58181 - bsc#1253924 Unbounded memory consumption in golang.org/x/crypto/ssh.
    • GO-2025-4116 - CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent.
    • GO-2025-3595 - CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net.
    • GO-2025-3503 - CVE-2025-22870 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.
    • GO-2025-3487 - CVE-2025-22869 Potential denial of service in golang.org/x/crypto.
    • GO-2025-3485 - CVE-2025-27144 DoS in go-jose Parsing in github.com/go-jose/go-jose.
    • GO-2025-3754 - CVE-2025-8556 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl.

  • No need for binutils-gold for aarch64

  • Update to 1.4.3

    • Corrected the mconfig -s option for statically building apptainer and starter binaries.
    • Resolved an issue where the Makefile generated by mconfig -b failed when the build directory was not a subdirectory of the Apptainer source code.
    • Fixed %files in definition files to correctly copy symlinks pointing above the destination directory but within the destination stage root filesystem.
    • Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was corrected to libnvoptix.so).
    • Prevented timeouts during cleanup after building gocryptfs-encrypted SIF files.
    • Fixed a bug that prevented build with --passphrase or --pem-path (without --encrypt) from implying fakeroot.
    • Resolved a hang when copying files between build stages while using suid mode without user namespaces.
    • Fixed issues with running and building containers of different architectures than the host via binfmt_misc when using rootless fakeroot.
    • Corrected "target: no such file or directory" errors when …
Record
openSUSE-SU-2026:20730-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2025:4395-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20251209T172047 2025-12-09T17:20:47Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4006 CVE-2025-61725
    • GO-2025-4176 CVE-2025-65105 GHSA-j3rw-fx6g-q46j
    • GO-2025-4177 CVE-2025-64750 GHSA-wwrx-w7c9-rf87
    • GO-2025-4178 CVE-2025-13870 GHSA-58w6-w55x-6wq8
    • GO-2025-4179 CVE-2025-64443 GHSA-46gc-mwh4-cc5r
    • GO-2025-4180 CVE-2025-44005 GHSA-h8cp-697h-8c8p
    • GO-2025-4181 CVE-2025-66406 GHSA-j7c9-79x7-8hpr
    • GO-2025-4182 CVE-2025-66411 GHSA-jf75-p25m-pw74
    • GO-2025-4183 CVE-2017-18870 GHSA-9j9j-mm2r-9rfm
    • GO-2025-4184 CVE-2017-18871 GHSA-jc6w-8r7f-vmp5
    • GO-2025-4185 CVE-2017-18902 GHSA-jwfv-5hwq-f97r
    • GO-2025-4186 CVE-2017-18875 GHSA-9rr5-q43r-ccv4
    • GO-2025-4187 CVE-2017-18876 GHSA-hjqh-j6rj-gh8q
    • GO-2025-4189 CVE-2017-18879 GHSA-498j-wxww-j897
    • GO-2025-4190 CVE-2017-18877 GHSA-9x8x-w6g5-hx4w
    • GO-2025-4192 CVE-2025-66564 GHSA-4qg8-fj49-pxjh
    • GO-2025-4193 CVE-2025-66506 GHSA-f83f-xpx7-ffpw
    • GO-2025-4197 CVE-2017-18884 GHSA-876j-jfqf-m7j7
    • GO-2025-4198 CVE-2017-18883 GHSA-w8cc-3h7q-jhc3

  • Update to version 0.0.20251203T174324 2025-12-03T17:43:24Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4155 CVE-2025-61729
    • GO-2025-4163 CVE-2025-60638 GHSA-f2hj-vpp9-6vm2
    • GO-2025-4164 CVE-2025-60632 GHSA-vgq7-9r5r-j9v3
    • GO-2025-4171 CVE-2025-66410 GHSA-jrhg-82w2-vvj7
    • GO-2025-4172 CVE-2025-12756 GHSA-p6gj-jc38-x2m7
    • GO-2025-4174 CVE-2025-13353 GHSA-69jw-4jj8-fcxm
    • GO-2025-4175 CVE-2025-61727

  • Update to version 0.0.20251125T181218 2025-11-25T18:12:18Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4133 CVE-2025-55074 GHSA-9hh7-6558-qfp2
    • GO-2025-4138 CVE-2025-65025 GHSA-h3mw-4f23-gwpw
    • GO-2025-4139 CVE-2025-65026 GHSA-hcpf-qv9m-vfgp
    • GO-2025-4146 CVE-2018-21258 GHSA-5mh6-p63g-3mv5
    • GO-2025-4147 GHSA-6xvf-4vh9-mw47
    • GO-2025-4149 CVE-2025-13425 GHSA-f786-75f3-74xj
    • GO-2025-4150 CVE-2025-64751 GHSA-2c64-vmv2-hgfc
    • GO-2025-4151 CVE-2025-65111 GHSA-9m7r-g8hg-x3vr
    • GO-2025-4152 CVE-2025-13357 GHSA-gmm6-j2g5-r52m
    • GO-2025-4153 CVE-2025-41115 GHSA-w62r-7c53-fmc5
    • GO-2025-4156 CVE-2025-64761 GHSA-7ff4-jw48-3436
    • GO-2025-4157 GHSA-2fcv-qww3-9v6h
    • GO-2025-4158 GHSA-rj4j-2jph-gg43
    • GO-2025-4159 GHSA-xq4h-wqm2-668w
    • GO-2025-4160 CVE-2025-65965 GHSA-6gxw-85q2-q646
Record
SUSE-SU-2025:4395-1
Updated
2026-11-02
OSVSUSE-SU-2026:0439-1 No score

Security update for apptainer

This update for apptainer fixes the following issues:

Security fixes:

  • CVE-2024-45310: Fixed runc being tricked into creating empty files/directories on host (bsc#1257432)
  • CVE-2025-65105: Fixed security bypass due to disabling security options (bsc#1255462)
  • CVE-2025-47914: Fixed malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent (bsc#1253967)
  • CVE-2025-58181: Fixed unbounded memory consumption in golang.org/x/crypto/ssh (bsc#1253784)
  • CVE-2025-47913: Fixed potential denial of service in golang.org/x/crypto/ssh/agent (bsc#1253506)
  • CVE-2025-22872: Fixed incorrect Neutralization of Input During Web Page Generation in x/net (bsc#1241710)
  • CVE-2025-22870: Fixed HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (bsc#1238611)
  • CVE-2025-22869: Fixed potential denial of service in golang.org/x/crypto (bsc#1239322)
  • CVE-2025-27144: Fixed DoS in go-jose Parsing in github.com/go-jose/go-jose (bsc#1237608)
  • CVE-2025-8556: Fixed missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl

Other fixes:

  • Update to 1.4.5
Record
SUSE-SU-2026:0439-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/apptainer/apptainer
Go
 before 1.4.5
1.4.5
apptainer
Alpine:v3.23
 before 1.4.5-r0
1.4.5-r0
apptainer
Alpine:v3.24
 before 1.4.5-r0
1.4.5-r0
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 37 CVEs
 before 0.0.20251209T172047-150000.1.127.1
0.0.20251209T172047-150000.1.127.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 37 CVEs
 before 0.0.20251209T172047-150000.1.127.1
0.0.20251209T172047-150000.1.127.1
apptainer
SUSE:Linux Enterprise Module for HPC 15 SP7
From an advisory covering 10 CVEs
 before 1.4.5-150600.4.12.1
1.4.5-150600.4.12.1
squashfuse
SUSE:Linux Enterprise Module for HPC 15 SP7
From an advisory covering 10 CVEs
 before 0.5.0-150600.3.2.1
0.5.0-150600.3.2.1
apptainer
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 1.4.5-150600.4.12.1
1.4.5-150600.4.12.1
squashfuse
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 0.5.0-150600.3.2.1
0.5.0-150600.3.2.1
apptainer
openSUSE:Leap 15.6
From an advisory covering 10 CVEs
 before 1.4.5-150600.4.12.1
1.4.5-150600.4.12.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
squashfuse
openSUSE:Leap 15.6
From an advisory covering 10 CVEs
 before 0.5.0-150600.3.2.1
0.5.0-150600.3.2.1
apptainer
Ubuntu:25.10
 All versions, plus listed versions
1.4.0-51.4.0-6
 None known
apptainer
Ubuntu:26.10
 All versions, plus listed versions
1.4.5-11.4.5-2ubuntu1
 None known
apptainer
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.4.0-61.4.4-11.4.4-21.4.5-1
 None known
apptainer
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 1.4.5-1.1
1.4.5-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-65105 is a medium vulnerability (CVSS 4.5) in Apptainer, published December 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in github.com/apptainer/apptainer 1.4.5.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,583 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open