CVE-2025-65105

mediumPriorität · verfolgen · 21EPSS 0.002 · 14. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.23% (14th) EPSS

CVSS 5.3 · medium

Is it mine?

3 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenapptainer-0:1.4.5-150600.4.12.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-150600.4.12.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-150600.4.12.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-150600.4.12.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-150600.4.12.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-150600.4.12.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-leap-0:1.4.5-150600.4.12.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_6-0:1.4.5-150600.4.12.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_6-0:1.4.5-150600.4.12.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_7-0:1.4.5-150600.4.12.1.noarch as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenlibsquashfuse0-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-devel-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-devel-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-devel-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-devel-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobensquashfuse-tools-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-leap-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-leap-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-leap-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-leap-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_7-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_7-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_7-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle15_7-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle16-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle16-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle16-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobenapptainer-sle16-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 1.4

v3.14.5mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.14.5mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · security-advisories@github.comAusnutzbarkeit 1 · Auswirkung 3.4

v3.14.5mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · SUSE Product Security

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-61USCWE-61USCWE-706USCWE-706US

betroffene Produkte (3)

Betroffene Produkte und Versionsbereiche.

apptainer apptainer≤ < 1.4.5enisa_euvdEU
lfprojects apptainer< 1.4.5nvdUScpe:2.3:a:lfprojects:apptainer:*:*:*:*:*:*:*:*
Go github.com/apptainer/apptainer< 1.4.5osvUSpkg:golang/github.com/apptainer/apptainer

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

SUSE-SU-2026:0439-1Security update for apptainer2026-02-11csaf · suse_csafDE
Security update for apptainer
openSUSE-SU-2026:10013-1apptainer-1.4.5-1.1 on GA media2026-01-07csaf · suse_csafDE
apptainer-1.4.5-1.1 on GA media
GHSA-j3rw-fx6g-q46jApptainer ineffectively applies selinux and apparmor --security options2025-12-02ghsa · osvUS
### Impact In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used `--security` option, in particular the forms `--security=apparmor:<profile>` and `--security=selinux:<label>` which otherwise put restrictions on operations that containers can do. The `--security` option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. In addition, a bug in the detection of selinux support in Apptainer's suid mode means that `--security selinux:<label>` flags may not be applied, even in the absence of an attack. In that case a warning message is emitted indicating that selinux is unavailable, but the warning may be may be overlooked, mis-interpreted, or not seen when apptainer is run from a script or other tool. Failure to apply requested restrictions should result in a fatal error rather than just a warning message. ### Patches Ineffective write of selinux process labels is addressed via an update to the containers/selinux dependency in https://github.com/apptainer/apptainer/pull/3226. That update brings in the upstream fix for https://github.com/advisories/GHSA-cgrx-mc8f-2prm which was for a different but related vulnerability. Ineffective write of apparmor process profiles is addressed in commit 4313b42. Failure to detect apparmor / selinux support, when --security flags are provided, is made an error rather than a warning in commit 82f1790. ### Workarounds There are no known workarounds, other than to define system-wide apparmor / selinux policy for Apptainer itself. This would apply to all containers, not just those run with the `--security` flags, and could impact the operation of Apptainer itself. ### References Thanks to Sylabs for finding this issue, fixing it in https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 which was easy to import into Apptainer, and disclosing it early to the Apptainer project for a coordinated release. The related upstream runc disclosure which inspired the investigation is https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm.
GO-2025-4176Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer2025-12-08vendor · osvUS
Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd suse_csaf NVD CVE.org MITRE

veröffentlicht 2025-12-02geändert 2026-10-18

Referenzen (20)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan