Bug 2418392 (CVE-2025-65105) - CVE-2025-65105 Apptainer: Apptainer: Security bypass due to disabling security options
Summary: CVE-2025-65105 Apptainer: Apptainer: Security bypass due to disabling securit...
Keywords:
Status: NEW
Alias: CVE-2025-65105
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2417548 2423028 2423029 2423030 2423031 2423032
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-02 18:01 UTC by OSIDB Bzimport
Modified: 2025-12-17 20:10 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-12-02 18:01:49 UTC
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.


Note You need to log in before you can comment on or make changes to this bug.