Skip to content
OpenAdvisories
Medium · 4.5 CVE-2025-65105 EUVD-2025-200292GHSA-j3rw-fx6g-q46jGO-2025-4176

Apptainer ineffective application of selinux and apparmor --security options

Published Dec 2, 2025 · Updated Dec 2, 2025 · Assigned by GitHub_M

Description

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Affected products

VendorProductAffectedFixed
apptainer apptainer < 1.4.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 apptainer No fix yet —
Ubuntu 26.04 LTS apptainer No fix yet —
Ubuntu 25.10 apptainer No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 apptainer 1.4.5-150600.4.12.1 SUSE-SU-2026:0439-1
SLES 15 SP7 squashfuse 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1
SLES 15 SP6 apptainer 1.4.5-150600.4.12.1 SUSE-SU-2026:0439-1
SLES 15 SP6 govulncheck-vulndb 0.0.20251209T172047-150000.1.127.1 SUSE-SU-2025:4395-1
SLES 15 SP6 squashfuse 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apptainer 1.4.5-1.1 openSUSE-SU-2026:10013-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 apptainer 1.4.5-150600.4.12.1 SUSE-SU-2026:0439-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20251209T172047-150000.1.127.1 SUSE-SU-2025:4395-1
openSUSE Leap 15.6 squashfuse 0.5.0-150600.3.2.1 SUSE-SU-2026:0439-1
ReleasePackageFixed inAdvisory
Alpine v3.24 apptainer 1.4.5-r0 —
Alpine v3.23 apptainer 1.4.5-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/apptainer/apptainer < 1.4.5 1.4.5 GHSA-j3rw-fx6g-q46j

Advisories 4

References