OPENSUSE-SU-2026:20730-1
Vulnerability from csaf_opensuse - Published: 2026-05-14 16:09 - Updated: 2026-09-17 17:32Summary
Security update for apptainer
Severity
Critical
Notes
Title of the patch: Security update for apptainer
Description of the patch: This update for apptainer fixes the following issues:
Changes in apptainer:
- Fix CVE-2026-34986 (bsc#1262956)
* github.com/go-jose/go-jose/v4@v4.1.4
CVE-2026-33186 GO-2026-4762 (bsc#1260311)
* google.golang.org/grpc@v1.79.3
CVE-2026-24137 GO-2026-4358 (bsc#1264177)
* github.com/sigstore/sigstore@v1.10.4
Fix fallout:
github.com/moby/go-archive@v0.1.0
github.com/containers/image/v5=github.com/containers/image/v5@v5.36.0
- Fix HTML parser misimplementation of a part of the HTML
specification for table related tags (CVE-2025-58190,
GO-2026-4441, bsc#1258048).
- Fix issue where the HTML parser takes a very long time or
even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).
- Update ot 1.4.5
* Fix for moderate severity GO-2025-4176 / CVE-2025-65105 /
GHSA-j3rw-fx6g-q46j (bsc#1255462):
Ineffective application of selinux / apparmor --security option.
Updates of a few dependent go libraries for related security fixes.
* Other fix
Run FUSE processes in a separate process group. This detaches them
from the main process so they don't receive signals such as interrupts
sent to a terminal there. This was not a problem with interactive
shells because they start their own group, but was a problem with
some programs with interactive Read/Eval/Print/Loops such as python.
An interrupt there would kill the FUSE processes.
- From 1.4.4
* By applying patches to the bundled fuse2fs, allow again the possibility
of using a non-writable ext3 image file as an overlay. Fixes regression
introduced in 1.4.3.
* If an overlay or bound data image is asked to be mounted writable but
the user has no write access to the image, show a warning message
instead of silently switching to readonly.
* Avoid a fatal error when starting fakeroot from suid mode while
in an NFS directory.
* Fix 32-bit builds which were accidentally broken by a library
upgrade that was done for a minor security issue.
- Fix CVEs:
* GO-2025-4135 - CVE-2025-47914
Malformed constraint may cause denial of service in
golang.org/x/crypto/ssh/agent.
* GO-2025-4134 - CVE-2025-58181 - bsc#1253924
Unbounded memory consumption in golang.org/x/crypto/ssh.
* GO-2025-4116 - CVE-2025-47913
Potential denial of service in golang.org/x/crypto/ssh/agent.
* GO-2025-3595 - CVE-2025-22872
Incorrect Neutralization of Input During Web Page Generation
in x/net.
* GO-2025-3503 - CVE-2025-22870
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.
* GO-2025-3487 - CVE-2025-22869
Potential denial of service in golang.org/x/crypto.
* GO-2025-3485 - CVE-2025-27144
DoS in go-jose Parsing in github.com/go-jose/go-jose.
* GO-2025-3754 - CVE-2025-8556
CIRCL-Fourq: Missing and wrong validation can lead to
incorrect results in github.com/cloudflare/circl.
- No need for binutils-gold for aarch64
- Update to 1.4.3
* Corrected the mconfig -s option for statically building apptainer
and starter binaries.
* Resolved an issue where the Makefile generated by mconfig -b
failed when the build directory was not a subdirectory of the
Apptainer source code.
* Fixed %files in definition files to correctly copy symlinks
pointing above the destination directory but within the
destination stage root filesystem.
* Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was
corrected to libnvoptix.so).
* Prevented timeouts during cleanup after building
gocryptfs-encrypted SIF files.
* Fixed a bug that prevented build with --passphrase or --pem-path
(without --encrypt) from implying fakeroot.
* Resolved a hang when copying files between build stages while
using suid mode without user namespaces.
* Fixed issues with running and building containers of different
architectures than the host via binfmt_misc when using rootless
fakeroot.
* Corrected "target: no such file or directory" errors when
extracting layers from certain OCI images that manipulate hard
links across layers.
* Fixed a crash when executing a privilege-encrypted container as
root.
* Improved documentation for the remote list command.
* Removed the fakerootcallback functionality.
* Updated the default pacman confURL for Bootstrap: arch container
builds.
* Updated bundled fuse programs to their latest releases.
* Changed the default message level from silent to normal in
nested apptainer executions of a build's %post section, and
suppressed an unnecessary warning.
* Invalid environment variables are now ignored when pulling
oci/docker containers.
- Add definition file for SLE 16 (SLE-16.def).
- Remove definition files for SLE15 SP5 (SLE-15SP5.def) and
SP6 (SLE-15SP6.def).
- Update to 1.4.2
* Restore looking for registry mirrors in /etc/containers/registry.conf
and related files. This had been inadvertently dropped beginning in 1.4.0.
* Fix use of the image cache when the home directory contains @ characters.
Previously it would assume that it was the start of a digest in the oci-dir.
* Fix signature verification failures on unsigned images.
* Add additional .deb packages to the release assets that include the label
trixie+ to indicate that they are for installing on Debian 13 or later.
Those packages are necessary to work with the new libfuse3 library in
Debian13. They also support libsubid, unlike the default packages because
they are built on Debian 11 which doesn't have that library.
* Add automatic triggering of Ubuntu PPA builds whenever there's a new
apptainer release.
- Update to 1.4.1
* Fix the use of libsubid which had been broken by the revision
applied in 1.4.0-rc.2.
* Fix a bug introduced in 1.4.0 that caused arm64 to be
mis-converted to arm64v8 and resulted in a failure when pulling
OCI containers.
* Fix user database lookup in master process preventing instance
from starting correctly on systems using winbind.
* Check for existence of `/run/systemd/system` when verifying
cgroups can be used via systemd manager.
* Add a clear error message if someone tries to use privileged
network options while not using setuid mode.
* Allow multi-arch oci-archive files that have a nested index
with the manifest. This is the default format (both for Docker
and OCI) when using `nerdctl save`.
* Test if docker-archive is actually an oci-archive (since Docker
version 25), and if it is oci then use the OCI parser to avoid
bugs in the Docker parser. Save the daemon-daemon references
to a temporary docker-archive, to benefit from the same
improvements also for those references. Parse as oci-archive.
- New Features & Functionality in from ineherited 1.4.0
* Add new build option `--mksquashfs-args` to pass additional
arguments to the `mksquashfs` command when building SIF files.
If a compression method other than gzip is selected, the SIF
file might not work with older installations of Apptainer
or Singularity, so an INFO message about that is printed. On
the other hand, an INFO message that was printed (twice) when
running an image with non-gzip compression has been removed.
* If the `mksquashfs` version is new enough (version 4.6 in
Leaep 16.0), then show a percentage progress bar (with ETA)
during SIF creation in the default log level. If the `mksquashfs`
version is older, then in verbose or debug log level show the
output of mksquashfs with its own progress bar.
* Statistics are now normally available for instances that are
started by non-root users on cgroups v2 systems. The instance
will be started in the current cgroup. Information about
configuration issues that prevent collection of statistics are
displayed as INFO messages by default.
* Add a `--sandbox` option to `apptainer pull`.
* Add configuration file binding to the `--nv` option. Files
that are recognized in the NVIDIA Container Toolkit, including
files for EGL ICD, were added to the default `nvliblist.conf`.
* It is now possible to use multiple environment variable files
using the `--env-file` flag. Files can be specified as a
comma-separated list or by using the flag multiple times.
Variables defined in later files take precedence over earlier
files.
* The registry login and registry logout commands now support a
`--authfile <path>` option, which causes OCI credentials to be
written to / removed from a custom file located at `<path>`
instead of the default location (`$HOME/.apptainer/docker-config.json`).
The commands `pull`, `push`, `run`, `exec`, `shell` and
instance start can now also be passed a `--authfile <path>`
option, to read OCI registry credentials from this custom file.
* A new `--netns-path` option takes a path to a network
namespace to join when starting a container. The root user
may join any network namespace. An unprivileged user can only
join a network namespace specified in the new `allow netns
paths` directive in `apptainer.conf`, if they are also listed
in `allow net users` / `allow net groups` and apptainer is
installed with setuid privileges. Not supported with
`--fakeroot`.
* `apptainer.conf` now accepts setting the following options:
`allow ipc ns` -- Default value is `yes`; when set to `no`,
it will disable the use of the `--ipc` flag.
`allow uts ns` -- Default value is `yes`; when set to `no`,
it will invalidate the use of the `--uts` and `--hostname`
flags.
`allow user ns` -- Default value is `yes`; when set to
`no`, it will disable creation of user namespaces. Note
that this will prevent execution of containers with the
`--userns` or `--fakeroot` flags and with unprivileged
installations of Apptainer.
- Changed defaults / behaviours
* Label the starter process seen in `ps` with the image filename,
for example: Apptainer runtime parent: `example.sif`.
* Remove runtime and compute libraries from `rocmliblist.conf`.
They should instead be provided by the container image.
* Allow overriding the build architecture with `--arch` and
`--arch-variant`, to build images for another architecture
than the current host arch. This requires that the host has
been set up to support multiple architectures (`binfmt_misc`).
* Complete the previously partial support for the riscv64
architecture.
* Show a warning message if changing directory to the cwd
fails, instead of silently switching to the home directory
or `/`.
* Write starter messages to stderr when an instance fails to
start. Previously they were incorrectly written to stdout.
* Skip attempting to bind inaccessible mount points when
handling the `mount hostfs = yes` configuration option.
* Fix storage of credentials for `docker.io` to behave the same
as for `index.docker.io`.
* Change message log level from warning to debug when environment
variables set inside a container or by `APPTAINERENV` have a
different value than the environment variable on the host.
* Change the default message level from silent to the normal
level in the nested apptainer that executes a build's `%post`
section, and suppress an unnecessary warning message.
* Ignore invalid environment variables when pulling oci/docker
containers.
* Remove the little-known `fakerootcallback` functionality.
* Update the default pacman confURL for `Bootstrap: arch`
container builds.
* Update the bundled fuse programs to their latest releases.
- Bug fixes
* Fix the `mconfig -s` option to build the apptainer and starter
binaries statically as documented.
* `%files from` in a definition file will now correctly copy
symlinks that `%point` to a target above the destination
directory but inside the `%destination` stage root filesystem.
* Fixed typo in `nvliblist.conf` (`libnvoptix.so.1` -> `libnvoptix.so`).
* Avoid timeouts when cleaning up from building gocryptfs-encrypted
SIF files.
* Fix bug that prevented build with `--passphrase` or
`--pem-path` but without `--encrypt` from implying fakeroot.
* Fix hang when copying files between build stages while using
suid mode without user namespaces.
* Fix running and building containers of different architectures
than the host via binfmt_misc when using rootless fakeroot.
* Fix `target: no such file or directory` error when extracting
layers from certain OCI images that manipulate hard links
across layers.
* Fix the crash that happened when executing a privilege-encrypted
container as root.
- Fix CVE-2024-45338, CVE-2025-22870, CVE-2024-45337, CVE-2025-22869, CVE-2025-27144 CVE-2024-41110
* GO-2024-3333 CVE-2024-45338 (bsc#1234794)
GO-2025-3503 CVE-2025-22870 (bsc#1238611):
Update to: golang.org/x/net@v0.36.0
* GO-2024-3321 CVE-2024-45337 (bsc#1234595)
GO-2025-3487 CVE-2025-22869 (bsc#1239341):
Update to: golang.org/x/crypto@v0.35.0
* GO-2025-3485 CVE-2025-27144 (bsc#1237679):
Update to: github.com/go-jose/go-jose/v3@v3.0.4
* GO-2024-3005 CVE-2024-41110 (bsc#1228324):
Update to: github.com/docker/docker@v25.0.6+incompatible
- Update golang.org/x/net to v0.23 to fix CVE-2023-45288 (bnc#1236528).
- Update to version 1.3.6
* Avoid using kernel overlayfs when the lower layer is a sandbox
on an incompatible filesystem type such as GPFS or Lustre.
For those cases use fuse-overlayfs instead. This fixes a
regression introduced in 1.3.0. The regression didn't much
impact Lustre because kernel overlayfs refused to try to use
it and Apptainer proceeded to use fuse-overlayfs anyway, but
with GPFS the kernel overlayfs allowed mounting but returned
stale file handle errors.
- Version 1.3.5
* Fix a regression introduced in 1.3.4 that overwrote existing
standard `/.singularity.d` files such as `runscript` in
container images even if they had been modified.
* Skip attempting to bind inaccessible mount points when
handling the `mount hostfs = yes` configuration option.
* Support parsing nested variables defined inside `%arguments`
section of definition files.
* Ignore invalid environment variables when pulling oci/docker
containers.
- Version 1.3.4
* Fixed sif-embedded overlay partitions for containers that are
larger than 2 gigabytes.
* Fixed the failure when starting apptainer with
`instance --fakeroot`.
* `apptainer build -B ...` can now be used to mount custom
resolv.conf and hosts files from non-standard outside locations.
This can be used to run `apptainer build` in a nix-build sandbox
that has no `/etc/resolv.conf`.
* Fixed failing builds from local images that have symbolic links
for paths that are part of the base container environment (e.g.
/var/tmp -> /tmp).
* Show info messages suggesting to use
`enable underlay = preferred` or the `--underlay` flag when
overlay is implied for bind mounts but the kernel is too old
to support fuse mounts in user namespaces and so tries to use
fusermount.
* When someone uses a `yum` bootstrap to build a container
without using subuid-based fakeroot or root, warn that it is
unlikely to work.
* Allow a writable `--overlay` to be used with `--nvccli` instead
of `--writable-tmpfs`.
* If an error "no descriptor found for reference" is seen while
getting an oci container, retry the operation up to five times.
* Make fakeroot Recommended for SUSE rpms instead of Required.
* Allow bind mounts onto existing files on r/o NFS filesystems.
* If an error is seen in the %post section when building a
container using fakeroot mode 3 (with the fakeroot command)
then show a message suggesting using `--ignore-fakeroot-command`
and referring to the documentation about how to install and use
it inside the container definition file.
* Show a more helpful error message when using fakeroot in suid
mode and there's an `/etc/subuid` mapping even though user
namespaces are not available (user namespaces are required for
`/etc/subuid` mapping).
- Version 1.3.3
* Added libcudadebugger.so to nvliblist.conf to support cuda-gdb
in CUDA 12+.
* Ensure opened/kept file descriptors in stage 1 are not closed
during the Go garbage collection to avoid "bad file descriptor"
errors at startup.
* Fixed a segmentation violation issue when running Apptainer
checkpoint.
* Fixed an issue that Apptainer won't read default docker
credentials.
- Version 1.3.2
* Fix for
[CVE-2024-3727](https://bugzilla.suse.com/show_bug.cgi?id=1224114)
in a dependent library which describes a flaw that can allow
attackers to trigger unexpected authenticated registry accesses
due to object digest values not being validated in all cases.
* Fixed the issue when nesting `apptainer instance start` inside
a container on cgroups-v2 capable host.
* Fixed the issue that oras download progress bar gets stuck
when downloading large images.
- Version 1.3.1
* Make 'apptainer build' work with signed Docker containers.
* Fixed regression introduced in 1.3.0 that prevented closing
cryptsetup and the corresponding loop device after running
an encrypted sif container file in suid mode.
* Stopped binding over the default timezone in the container
with the host's timezone, which led to unexpected behavior if
the application changed timezones.
* Added progress bars for `oras://` push and pull.
* Hide `Instance stats will not be available` message under
`--sharens` mode.
* Fix problem where credentials locally stored with
`registry login` command were not usable in some execution
flows. Run `registry login` again with latest version to ensure
credentials are stored correctly.
* Make runscript timeout configurable.
* Return invalid bind path mount options during bind path
parsing.
* Make the INFO message more helpful when a running background
process at exit time causes a FUSE mount to not shut down
cleanly.
* Fixed the wrong mediaType in the oras push manifest.
- Add Apptainer definition template for SLE15-SP7.
- Make sure, build is reproducible by setting the GNU build ID to one
derived from the Go one. See https://pkg.go.dev/cmd/link.
- Use go-jose version with fix for CVE-2024-28180 (bsc#1235211).
Patchnames: openSUSE-Leap-16.0-packagehub-255
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
8.3 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
9.9 (Critical)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
critical
8.1 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
4.4 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2023-45288
Threats
Impact
important
References
85 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for apptainer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for apptainer fixes the following issues:\n\nChanges in apptainer:\n\n- Fix CVE-2026-34986 (bsc#1262956)\n * github.com/go-jose/go-jose/v4@v4.1.4\n CVE-2026-33186 GO-2026-4762 (bsc#1260311)\n * google.golang.org/grpc@v1.79.3\n CVE-2026-24137 GO-2026-4358 (bsc#1264177)\n * github.com/sigstore/sigstore@v1.10.4\n Fix fallout:\n\tgithub.com/moby/go-archive@v0.1.0\n\tgithub.com/containers/image/v5=github.com/containers/image/v5@v5.36.0\n\n- Fix HTML parser misimplementation of a part of the HTML\n specification for table related tags (CVE-2025-58190,\n GO-2026-4441, bsc#1258048).\n- Fix issue where the HTML parser takes a very long time or\n even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).\n\n- Update ot 1.4.5\n * Fix for moderate severity GO-2025-4176 / CVE-2025-65105 /\n GHSA-j3rw-fx6g-q46j (bsc#1255462):\n Ineffective application of selinux / apparmor --security option.\n Updates of a few dependent go libraries for related security fixes.\n * Other fix\n Run FUSE processes in a separate process group. This detaches them\n from the main process so they don\u0027t receive signals such as interrupts\n sent to a terminal there. This was not a problem with interactive\n shells because they start their own group, but was a problem with\n some programs with interactive Read/Eval/Print/Loops such as python.\n An interrupt there would kill the FUSE processes.\n- From 1.4.4\n * By applying patches to the bundled fuse2fs, allow again the possibility\n of using a non-writable ext3 image file as an overlay. Fixes regression\n introduced in 1.4.3.\n * If an overlay or bound data image is asked to be mounted writable but\n the user has no write access to the image, show a warning message\n instead of silently switching to readonly.\n * Avoid a fatal error when starting fakeroot from suid mode while\n in an NFS directory.\n * Fix 32-bit builds which were accidentally broken by a library\n upgrade that was done for a minor security issue.\n- Fix CVEs:\n * GO-2025-4135 - CVE-2025-47914\n Malformed constraint may cause denial of service in\n golang.org/x/crypto/ssh/agent.\n * GO-2025-4134 - CVE-2025-58181 - bsc#1253924\n Unbounded memory consumption in golang.org/x/crypto/ssh.\n * GO-2025-4116 - CVE-2025-47913\n Potential denial of service in golang.org/x/crypto/ssh/agent.\n * GO-2025-3595 - CVE-2025-22872\n Incorrect Neutralization of Input During Web Page Generation\n in x/net.\n * GO-2025-3503 - CVE-2025-22870\n HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.\n * GO-2025-3487 - CVE-2025-22869\n Potential denial of service in golang.org/x/crypto.\n * GO-2025-3485 - CVE-2025-27144\n DoS in go-jose Parsing in github.com/go-jose/go-jose.\n * GO-2025-3754 - CVE-2025-8556\n CIRCL-Fourq: Missing and wrong validation can lead to\n incorrect results in github.com/cloudflare/circl.\n\n- No need for binutils-gold for aarch64\n\n- Update to 1.4.3\n * Corrected the mconfig -s option for statically building apptainer\n and starter binaries.\n * Resolved an issue where the Makefile generated by mconfig -b\n failed when the build directory was not a subdirectory of the\n Apptainer source code.\n * Fixed %files in definition files to correctly copy symlinks\n pointing above the destination directory but within the\n destination stage root filesystem.\n * Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was\n corrected to libnvoptix.so).\n * Prevented timeouts during cleanup after building\n gocryptfs-encrypted SIF files.\n * Fixed a bug that prevented build with --passphrase or --pem-path\n (without --encrypt) from implying fakeroot.\n * Resolved a hang when copying files between build stages while\n using suid mode without user namespaces.\n * Fixed issues with running and building containers of different\n architectures than the host via binfmt_misc when using rootless\n fakeroot.\n * Corrected \"target: no such file or directory\" errors when\n extracting layers from certain OCI images that manipulate hard\n links across layers.\n * Fixed a crash when executing a privilege-encrypted container as\n root.\n * Improved documentation for the remote list command.\n * Removed the fakerootcallback functionality.\n * Updated the default pacman confURL for Bootstrap: arch container\n builds.\n * Updated bundled fuse programs to their latest releases.\n * Changed the default message level from silent to normal in\n nested apptainer executions of a build\u0027s %post section, and\n suppressed an unnecessary warning.\n * Invalid environment variables are now ignored when pulling\n oci/docker containers.\n- Add definition file for SLE 16 (SLE-16.def).\n- Remove definition files for SLE15 SP5 (SLE-15SP5.def) and\n SP6 (SLE-15SP6.def).\n\n- Update to 1.4.2\n * Restore looking for registry mirrors in /etc/containers/registry.conf\n and related files. This had been inadvertently dropped beginning in 1.4.0.\n * Fix use of the image cache when the home directory contains @ characters.\n Previously it would assume that it was the start of a digest in the oci-dir.\n * Fix signature verification failures on unsigned images.\n * Add additional .deb packages to the release assets that include the label\n trixie+ to indicate that they are for installing on Debian 13 or later.\n Those packages are necessary to work with the new libfuse3 library in\n Debian13. They also support libsubid, unlike the default packages because\n they are built on Debian 11 which doesn\u0027t have that library.\n * Add automatic triggering of Ubuntu PPA builds whenever there\u0027s a new\n apptainer release.\n\n- Update to 1.4.1\n * Fix the use of libsubid which had been broken by the revision\n applied in 1.4.0-rc.2.\n * Fix a bug introduced in 1.4.0 that caused arm64 to be\n mis-converted to arm64v8 and resulted in a failure when pulling\n OCI containers.\n * Fix user database lookup in master process preventing instance\n from starting correctly on systems using winbind.\n * Check for existence of `/run/systemd/system` when verifying\n cgroups can be used via systemd manager.\n * Add a clear error message if someone tries to use privileged\n network options while not using setuid mode.\n * Allow multi-arch oci-archive files that have a nested index\n with the manifest. This is the default format (both for Docker\n and OCI) when using `nerdctl save`.\n * Test if docker-archive is actually an oci-archive (since Docker\n version 25), and if it is oci then use the OCI parser to avoid\n bugs in the Docker parser. Save the daemon-daemon references\n to a temporary docker-archive, to benefit from the same\n improvements also for those references. Parse as oci-archive.\n\n- New Features \u0026 Functionality in from ineherited 1.4.0\n * Add new build option `--mksquashfs-args` to pass additional\n arguments to the `mksquashfs` command when building SIF files.\n If a compression method other than gzip is selected, the SIF\n file might not work with older installations of Apptainer\n or Singularity, so an INFO message about that is printed. On\n the other hand, an INFO message that was printed (twice) when\n running an image with non-gzip compression has been removed.\n * If the `mksquashfs` version is new enough (version 4.6 in\n Leaep 16.0), then show a percentage progress bar (with ETA)\n during SIF creation in the default log level. If the `mksquashfs`\n version is older, then in verbose or debug log level show the\n output of mksquashfs with its own progress bar.\n * Statistics are now normally available for instances that are\n started by non-root users on cgroups v2 systems. The instance\n will be started in the current cgroup. Information about\n configuration issues that prevent collection of statistics are\n displayed as INFO messages by default.\n * Add a `--sandbox` option to `apptainer pull`.\n * Add configuration file binding to the `--nv` option. Files\n that are recognized in the NVIDIA Container Toolkit, including\n files for EGL ICD, were added to the default `nvliblist.conf`.\n * It is now possible to use multiple environment variable files\n using the `--env-file` flag. Files can be specified as a\n comma-separated list or by using the flag multiple times.\n Variables defined in later files take precedence over earlier\n files.\n * The registry login and registry logout commands now support a\n `--authfile \u003cpath\u003e` option, which causes OCI credentials to be\n written to / removed from a custom file located at `\u003cpath\u003e`\n instead of the default location (`$HOME/.apptainer/docker-config.json`).\n The commands `pull`, `push`, `run`, `exec`, `shell` and\n instance start can now also be passed a `--authfile \u003cpath\u003e`\n option, to read OCI registry credentials from this custom file.\n * A new `--netns-path` option takes a path to a network\n namespace to join when starting a container. The root user\n may join any network namespace. An unprivileged user can only\n join a network namespace specified in the new `allow netns\n paths` directive in `apptainer.conf`, if they are also listed\n in `allow net users` / `allow net groups` and apptainer is\n installed with setuid privileges. Not supported with\n `--fakeroot`.\n * `apptainer.conf` now accepts setting the following options:\n `allow ipc ns` -- Default value is `yes`; when set to `no`,\n\tit will disable the use of the `--ipc` flag.\n `allow uts ns` -- Default value is `yes`; when set to `no`,\n\tit will invalidate the use of the `--uts` and `--hostname`\n\tflags.\n `allow user ns` -- Default value is `yes`; when set to\n\t`no`, it will disable creation of user namespaces. Note\n\tthat this will prevent execution of containers with the\n\t`--userns` or `--fakeroot` flags and with unprivileged\n\tinstallations of Apptainer.\n- Changed defaults / behaviours\n * Label the starter process seen in `ps` with the image filename,\n for example: Apptainer runtime parent: `example.sif`.\n * Remove runtime and compute libraries from `rocmliblist.conf`.\n They should instead be provided by the container image.\n * Allow overriding the build architecture with `--arch` and\n `--arch-variant`, to build images for another architecture\n than the current host arch. This requires that the host has\n been set up to support multiple architectures (`binfmt_misc`).\n * Complete the previously partial support for the riscv64\n architecture.\n * Show a warning message if changing directory to the cwd\n fails, instead of silently switching to the home directory\n or `/`.\n * Write starter messages to stderr when an instance fails to\n start. Previously they were incorrectly written to stdout.\n * Skip attempting to bind inaccessible mount points when\n handling the `mount hostfs = yes` configuration option.\n * Fix storage of credentials for `docker.io` to behave the same\n as for `index.docker.io`.\n * Change message log level from warning to debug when environment\n variables set inside a container or by `APPTAINERENV` have a\n different value than the environment variable on the host.\n * Change the default message level from silent to the normal\n level in the nested apptainer that executes a build\u0027s `%post`\n section, and suppress an unnecessary warning message.\n * Ignore invalid environment variables when pulling oci/docker\n containers.\n * Remove the little-known `fakerootcallback` functionality.\n * Update the default pacman confURL for `Bootstrap: arch`\n container builds.\n * Update the bundled fuse programs to their latest releases.\n- Bug fixes\n * Fix the `mconfig -s` option to build the apptainer and starter\n binaries statically as documented.\n * `%files from` in a definition file will now correctly copy\n symlinks that `%point` to a target above the destination\n directory but inside the `%destination` stage root filesystem.\n * Fixed typo in `nvliblist.conf` (`libnvoptix.so.1` -\u003e `libnvoptix.so`).\n * Avoid timeouts when cleaning up from building gocryptfs-encrypted\n SIF files.\n * Fix bug that prevented build with `--passphrase` or\n `--pem-path` but without `--encrypt` from implying fakeroot.\n * Fix hang when copying files between build stages while using\n suid mode without user namespaces.\n * Fix running and building containers of different architectures\n than the host via binfmt_misc when using rootless fakeroot.\n * Fix `target: no such file or directory` error when extracting\n layers from certain OCI images that manipulate hard links\n across layers.\n * Fix the crash that happened when executing a privilege-encrypted\n container as root.\n\n- Fix CVE-2024-45338, CVE-2025-22870, CVE-2024-45337, CVE-2025-22869, CVE-2025-27144 CVE-2024-41110\n * GO-2024-3333 CVE-2024-45338 (bsc#1234794)\n GO-2025-3503 CVE-2025-22870 (bsc#1238611):\n Update to: golang.org/x/net@v0.36.0\n * GO-2024-3321 CVE-2024-45337 (bsc#1234595)\n GO-2025-3487 CVE-2025-22869 (bsc#1239341):\n Update to: golang.org/x/crypto@v0.35.0\n * GO-2025-3485 CVE-2025-27144 (bsc#1237679):\n Update to: github.com/go-jose/go-jose/v3@v3.0.4\n * GO-2024-3005 CVE-2024-41110 (bsc#1228324):\n Update to: github.com/docker/docker@v25.0.6+incompatible\n\n- Update golang.org/x/net to v0.23 to fix CVE-2023-45288 (bnc#1236528).\n\n- Update to version 1.3.6\n * Avoid using kernel overlayfs when the lower layer is a sandbox\n on an incompatible filesystem type such as GPFS or Lustre.\n For those cases use fuse-overlayfs instead. This fixes a\n regression introduced in 1.3.0. The regression didn\u0027t much\n impact Lustre because kernel overlayfs refused to try to use\n it and Apptainer proceeded to use fuse-overlayfs anyway, but\n with GPFS the kernel overlayfs allowed mounting but returned\n stale file handle errors.\n\n- Version 1.3.5\n * Fix a regression introduced in 1.3.4 that overwrote existing\n standard `/.singularity.d` files such as `runscript` in\n container images even if they had been modified.\n * Skip attempting to bind inaccessible mount points when\n handling the `mount hostfs = yes` configuration option.\n * Support parsing nested variables defined inside `%arguments`\n section of definition files.\n * Ignore invalid environment variables when pulling oci/docker\n containers.\n\n- Version 1.3.4\n * Fixed sif-embedded overlay partitions for containers that are\n larger than 2 gigabytes.\n * Fixed the failure when starting apptainer with\n `instance --fakeroot`.\n * `apptainer build -B ...` can now be used to mount custom\n resolv.conf and hosts files from non-standard outside locations.\n This can be used to run `apptainer build` in a nix-build sandbox\n that has no `/etc/resolv.conf`.\n * Fixed failing builds from local images that have symbolic links\n for paths that are part of the base container environment (e.g.\n /var/tmp -\u003e /tmp).\n * Show info messages suggesting to use\n `enable underlay = preferred` or the `--underlay` flag when\n overlay is implied for bind mounts but the kernel is too old\n to support fuse mounts in user namespaces and so tries to use\n fusermount.\n * When someone uses a `yum` bootstrap to build a container\n without using subuid-based fakeroot or root, warn that it is\n unlikely to work.\n * Allow a writable `--overlay` to be used with `--nvccli` instead\n of `--writable-tmpfs`.\n * If an error \"no descriptor found for reference\" is seen while\n getting an oci container, retry the operation up to five times.\n * Make fakeroot Recommended for SUSE rpms instead of Required.\n * Allow bind mounts onto existing files on r/o NFS filesystems.\n * If an error is seen in the %post section when building a\n container using fakeroot mode 3 (with the fakeroot command)\n then show a message suggesting using `--ignore-fakeroot-command`\n and referring to the documentation about how to install and use\n it inside the container definition file.\n * Show a more helpful error message when using fakeroot in suid\n mode and there\u0027s an `/etc/subuid` mapping even though user\n namespaces are not available (user namespaces are required for\n `/etc/subuid` mapping).\n\n- Version 1.3.3\n * Added libcudadebugger.so to nvliblist.conf to support cuda-gdb\n in CUDA 12+.\n * Ensure opened/kept file descriptors in stage 1 are not closed\n during the Go garbage collection to avoid \"bad file descriptor\"\n errors at startup.\n * Fixed a segmentation violation issue when running Apptainer\n checkpoint.\n * Fixed an issue that Apptainer won\u0027t read default docker\n credentials.\n\n- Version 1.3.2\n * Fix for\n [CVE-2024-3727](https://bugzilla.suse.com/show_bug.cgi?id=1224114)\n in a dependent library which describes a flaw that can allow\n attackers to trigger unexpected authenticated registry accesses\n due to object digest values not being validated in all cases.\n * Fixed the issue when nesting `apptainer instance start` inside\n a container on cgroups-v2 capable host.\n * Fixed the issue that oras download progress bar gets stuck\n when downloading large images.\n\n- Version 1.3.1\n * Make \u0027apptainer build\u0027 work with signed Docker containers.\n * Fixed regression introduced in 1.3.0 that prevented closing\n cryptsetup and the corresponding loop device after running\n an encrypted sif container file in suid mode.\n * Stopped binding over the default timezone in the container\n with the host\u0027s timezone, which led to unexpected behavior if\n the application changed timezones.\n * Added progress bars for `oras://` push and pull.\n * Hide `Instance stats will not be available` message under\n `--sharens` mode.\n * Fix problem where credentials locally stored with\n `registry login` command were not usable in some execution\n flows. Run `registry login` again with latest version to ensure\n credentials are stored correctly.\n * Make runscript timeout configurable.\n * Return invalid bind path mount options during bind path\n parsing.\n * Make the INFO message more helpful when a running background\n process at exit time causes a FUSE mount to not shut down\n cleanly.\n * Fixed the wrong mediaType in the oras push manifest.\n- Add Apptainer definition template for SLE15-SP7.\n\n- Make sure, build is reproducible by setting the GNU build ID to one\n derived from the Go one. See https://pkg.go.dev/cmd/link.\n\n- Use go-jose version with fix for CVE-2024-28180 (bsc#1235211).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-packagehub-255",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20730-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1228324",
"url": "https://bugzilla.suse.com/1228324"
},
{
"category": "self",
"summary": "SUSE Bug 1234595",
"url": "https://bugzilla.suse.com/1234595"
},
{
"category": "self",
"summary": "SUSE Bug 1234794",
"url": "https://bugzilla.suse.com/1234794"
},
{
"category": "self",
"summary": "SUSE Bug 1235211",
"url": "https://bugzilla.suse.com/1235211"
},
{
"category": "self",
"summary": "SUSE Bug 1236528",
"url": "https://bugzilla.suse.com/1236528"
},
{
"category": "self",
"summary": "SUSE Bug 1237679",
"url": "https://bugzilla.suse.com/1237679"
},
{
"category": "self",
"summary": "SUSE Bug 1238611",
"url": "https://bugzilla.suse.com/1238611"
},
{
"category": "self",
"summary": "SUSE Bug 1239341",
"url": "https://bugzilla.suse.com/1239341"
},
{
"category": "self",
"summary": "SUSE Bug 1253924",
"url": "https://bugzilla.suse.com/1253924"
},
{
"category": "self",
"summary": "SUSE Bug 1255462",
"url": "https://bugzilla.suse.com/1255462"
},
{
"category": "self",
"summary": "SUSE Bug 1258047",
"url": "https://bugzilla.suse.com/1258047"
},
{
"category": "self",
"summary": "SUSE Bug 1258048",
"url": "https://bugzilla.suse.com/1258048"
},
{
"category": "self",
"summary": "SUSE Bug 1260311",
"url": "https://bugzilla.suse.com/1260311"
},
{
"category": "self",
"summary": "SUSE Bug 1262956",
"url": "https://bugzilla.suse.com/1262956"
},
{
"category": "self",
"summary": "SUSE Bug 1264177",
"url": "https://bugzilla.suse.com/1264177"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45288 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45288/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-28180 page",
"url": "https://www.suse.com/security/cve/CVE-2024-28180/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-3727 page",
"url": "https://www.suse.com/security/cve/CVE-2024-3727/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-41110 page",
"url": "https://www.suse.com/security/cve/CVE-2024-41110/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45337 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45337/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45338 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22869 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22869/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22870 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22870/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22872 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22872/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-27144 page",
"url": "https://www.suse.com/security/cve/CVE-2025-27144/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47913 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47913/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47914 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47914/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58181 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58181/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-65105 page",
"url": "https://www.suse.com/security/cve/CVE-2025-65105/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-8556 page",
"url": "https://www.suse.com/security/cve/CVE-2025-8556/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-24137 page",
"url": "https://www.suse.com/security/cve/CVE-2026-24137/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-34986 page",
"url": "https://www.suse.com/security/cve/CVE-2026-34986/"
}
],
"title": "Security update for apptainer",
"tracking": {
"current_release_date": "2026-09-17T17:32:20Z",
"generator": {
"date": "2026-05-14T16:09:31Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:20730-1",
"initial_release_date": "2026-05-14T16:09:31Z",
"revision_history": [
{
"date": "2026-05-14T16:09:31Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:34:48Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:37:45Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-17T17:32:20Z",
"number": "4",
"summary": "unknown changes"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"product": {
"name": "apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"product_id": "apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:lfprojects:apptainer:1.4.5:*:*:*:*:go:*:*",
"purl": "pkg:rpm/suse/apptainer-leap@1.4.5-bp160.1.1?arch=noarch\u0026upstream=apptainer-0:1.4.5-bp160.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"product": {
"name": "apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"product_id": "apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:lfprojects:apptainer:1.4.5:*:*:*:*:go:*:*",
"purl": "pkg:rpm/suse/apptainer-sle15_7@1.4.5-bp160.1.1?arch=noarch\u0026upstream=apptainer-0:1.4.5-bp160.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "apptainer-sle16-0:1.4.5-bp160.1.1.noarch",
"product": {
"name": "apptainer-sle16-0:1.4.5-bp160.1.1.noarch",
"product_id": "apptainer-sle16-0:1.4.5-bp160.1.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/apptainer-sle16@1.4.5-bp160.1.1?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "apptainer-0:1.4.5-bp160.1.1.x86_64",
"product": {
"name": "apptainer-0:1.4.5-bp160.1.1.x86_64",
"product_id": "apptainer-0:1.4.5-bp160.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:lfprojects:apptainer:1.4.5:*:*:*:*:go:*:*",
"purl": "pkg:rpm/suse/apptainer@1.4.5-bp160.1.1?arch=x86_64\u0026upstream=apptainer-0:1.4.5-bp160.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-0:1.4.5-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64"
},
"product_reference": "apptainer-0:1.4.5-bp160.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-leap-0:1.4.5-bp160.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch"
},
"product_reference": "apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch"
},
"product_reference": "apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-sle16-0:1.4.5-bp160.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
},
"product_reference": "apptainer-sle16-0:1.4.5-bp160.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-45288",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45288"
}
],
"notes": [
{
"category": "general",
"text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45288",
"url": "https://www.suse.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "SUSE Bug 1221400 for CVE-2023-45288",
"url": "https://bugzilla.suse.com/1221400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2023-45288"
},
{
"cve": "CVE-2024-28180",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-28180"
}
],
"notes": [
{
"category": "general",
"text": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-28180",
"url": "https://www.suse.com/security/cve/CVE-2024-28180"
},
{
"category": "external",
"summary": "SUSE Bug 1234984 for CVE-2024-28180",
"url": "https://bugzilla.suse.com/1234984"
},
{
"category": "external",
"summary": "SUSE Bug 1235749 for CVE-2024-28180",
"url": "https://bugzilla.suse.com/1235749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2024-28180"
},
{
"cve": "CVE-2024-3727",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-3727"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-3727",
"url": "https://www.suse.com/security/cve/CVE-2024-3727"
},
{
"category": "external",
"summary": "SUSE Bug 1224112 for CVE-2024-3727",
"url": "https://bugzilla.suse.com/1224112"
},
{
"category": "external",
"summary": "SUSE Bug 1235749 for CVE-2024-3727",
"url": "https://bugzilla.suse.com/1235749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2024-3727"
},
{
"cve": "CVE-2024-41110",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-41110"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.\n\nUsing a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.\n\nA security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.\n\nDocker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.\n\ndocker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-41110",
"url": "https://www.suse.com/security/cve/CVE-2024-41110"
},
{
"category": "external",
"summary": "SUSE Bug 1228324 for CVE-2024-41110",
"url": "https://bugzilla.suse.com/1228324"
},
{
"category": "external",
"summary": "SUSE Bug 1230294 for CVE-2024-41110",
"url": "https://bugzilla.suse.com/1230294"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "critical"
}
],
"title": "CVE-2024-41110"
},
{
"cve": "CVE-2024-45337",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45337"
}
],
"notes": [
{
"category": "general",
"text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45337",
"url": "https://www.suse.com/security/cve/CVE-2024-45337"
},
{
"category": "external",
"summary": "SUSE Bug 1234482 for CVE-2024-45337",
"url": "https://bugzilla.suse.com/1234482"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2024-45337"
},
{
"cve": "CVE-2024-45338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45338"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45338",
"url": "https://www.suse.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "SUSE Bug 1234794 for CVE-2024-45338",
"url": "https://bugzilla.suse.com/1234794"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2024-45338"
},
{
"cve": "CVE-2025-22869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22869"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22869",
"url": "https://www.suse.com/security/cve/CVE-2025-22869"
},
{
"category": "external",
"summary": "SUSE Bug 1239322 for CVE-2025-22869",
"url": "https://bugzilla.suse.com/1239322"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2025-22869"
},
{
"cve": "CVE-2025-22870",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22870"
}
],
"notes": [
{
"category": "general",
"text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22870",
"url": "https://www.suse.com/security/cve/CVE-2025-22870"
},
{
"category": "external",
"summary": "SUSE Bug 1238572 for CVE-2025-22870",
"url": "https://bugzilla.suse.com/1238572"
},
{
"category": "external",
"summary": "SUSE Bug 1238611 for CVE-2025-22870",
"url": "https://bugzilla.suse.com/1238611"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-22870"
},
{
"cve": "CVE-2025-22872",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22872"
}
],
"notes": [
{
"category": "general",
"text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22872",
"url": "https://www.suse.com/security/cve/CVE-2025-22872"
},
{
"category": "external",
"summary": "SUSE Bug 1241710 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1241710"
},
{
"category": "external",
"summary": "SUSE Bug 1265255 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265255"
},
{
"category": "external",
"summary": "SUSE Bug 1265256 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265256"
},
{
"category": "external",
"summary": "SUSE Bug 1265259 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265259"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-22872"
},
{
"cve": "CVE-2025-27144",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-27144"
}
],
"notes": [
{
"category": "general",
"text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-27144",
"url": "https://www.suse.com/security/cve/CVE-2025-27144"
},
{
"category": "external",
"summary": "SUSE Bug 1237608 for CVE-2025-27144",
"url": "https://bugzilla.suse.com/1237608"
},
{
"category": "external",
"summary": "SUSE Bug 1237609 for CVE-2025-27144",
"url": "https://bugzilla.suse.com/1237609"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2025-27144"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-47913",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47913"
}
],
"notes": [
{
"category": "general",
"text": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47913",
"url": "https://www.suse.com/security/cve/CVE-2025-47913"
},
{
"category": "external",
"summary": "SUSE Bug 1253506 for CVE-2025-47913",
"url": "https://bugzilla.suse.com/1253506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2025-47913"
},
{
"cve": "CVE-2025-47914",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47914"
}
],
"notes": [
{
"category": "general",
"text": "SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47914",
"url": "https://www.suse.com/security/cve/CVE-2025-47914"
},
{
"category": "external",
"summary": "SUSE Bug 1253967 for CVE-2025-47914",
"url": "https://bugzilla.suse.com/1253967"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-47914"
},
{
"cve": "CVE-2025-58181",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58181"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58181",
"url": "https://www.suse.com/security/cve/CVE-2025-58181"
},
{
"category": "external",
"summary": "SUSE Bug 1253784 for CVE-2025-58181",
"url": "https://bugzilla.suse.com/1253784"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-58181"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2025-65105",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-65105"
}
],
"notes": [
{
"category": "general",
"text": "Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:\u003cprofile\u003e and --security=selinux:\u003clabel\u003e which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-65105",
"url": "https://www.suse.com/security/cve/CVE-2025-65105"
},
{
"category": "external",
"summary": "SUSE Bug 1255462 for CVE-2025-65105",
"url": "https://bugzilla.suse.com/1255462"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2025-65105"
},
{
"cve": "CVE-2025-8556",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-8556"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in CIRCL\u0027s implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-8556",
"url": "https://www.suse.com/security/cve/CVE-2025-8556"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "low"
}
],
"title": "CVE-2025-8556"
},
{
"cve": "CVE-2026-24137",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-24137"
}
],
"notes": [
{
"category": "general",
"text": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-24137",
"url": "https://www.suse.com/security/cve/CVE-2026-24137"
},
{
"category": "external",
"summary": "SUSE Bug 1257137 for CVE-2026-24137",
"url": "https://bugzilla.suse.com/1257137"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-24137"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-34986",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-34986"
}
],
"notes": [
{
"category": "general",
"text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-34986",
"url": "https://www.suse.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "SUSE Bug 1262805 for CVE-2026-34986",
"url": "https://bugzilla.suse.com/1262805"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:apptainer-0:1.4.5-bp160.1.1.x86_64",
"openSUSE Leap 16.0:apptainer-leap-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle15_7-0:1.4.5-bp160.1.1.noarch",
"openSUSE Leap 16.0:apptainer-sle16-0:1.4.5-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T16:09:31Z",
"details": "important"
}
],
"title": "CVE-2026-34986"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…