CVE-2025-65105

Name
CVE-2025-65105
Description
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981
MISC https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2
MISC https://github.com/apptainer/apptainer/pull/3226
CONFIRM https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j
MISC https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
MISC https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87

Match rules

CPE URI Source package Min version Max version
apptainer >= 0 < 1.4.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
apptainer edge-community 1.4.5-r0 Oleg Titov <oleg.titov@gmail.com> fixed
apptainer edge-community 1.4.4-r0 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.2-r2 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.2-r1 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.2-r0 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.1-r2 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.1-r1 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.1-r0 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.0-r2 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.0-r1 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.4.0-r0 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.3.6-r3 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.3.6-r2 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.3.6-r1 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.3.6-r0 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer edge-community 1.1.8-r0 None possibly vulnerable
apptainer edge-community 1.1.6-r0 None possibly vulnerable
apptainer edge-community 1.1.2-r0 None possibly vulnerable
apptainer 3.22-community 1.4.1-r4 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer 3.22-community 1.4.1-r3 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer 3.22-community 1.4.1-r2 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer 3.22-community 1.4.1-r1 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer 3.22-community 1.3.6-r5 Oleg Titov <oleg.titov@gmail.com> possibly vulnerable
apptainer 3.22-community 1.1.8-r0 None possibly vulnerable
apptainer 3.22-community 1.1.6-r0 None possibly vulnerable
apptainer 3.22-community 1.1.2-r0 None possibly vulnerable