{"id":"CVE-2025-65105","sourceIdentifier":"security-advisories@github.com","published":"2025-12-02T18:15:48.947","lastModified":"2026-10-18T18:10:00.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5."},{"lang":"es","value":"Apptainer es una plataforma de contenedores de código abierto. En versiones de Apptainer anteriores a la 1.4.5, un contenedor puede deshabilitar dos de las formas de la poco utilizada opción '--security', en particular las formas '--security=apparmor:<profile>' y '--security=selinux:<label>', las cuales de otro modo imponen restricciones a las operaciones que los contenedores pueden realizar. La opción '--security' siempre ha sido mencionada en la documentación de Apptainer como una característica para el usuario root, aunque estas formas también funcionan para usuarios sin privilegios en sistemas donde la característica correspondiente está habilitada. Apparmor está habilitado por defecto en distribuciones basadas en Debian y SElinux está habilitado por defecto en distribuciones basadas en RHEL, pero en SUSE depende de la versión de la distribución. Esta vulnerabilidad está corregida en la versión 1.4.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"apptainer","product":"apptainer","versions":[{"version":"< 1.4.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":4.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.0,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-02T18:43:58.398576Z","id":"CVE-2025-65105","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-61"},{"lang":"en","value":"CWE-706"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lfprojects:apptainer:*:*:*:*:*:go:*:*","versionEndExcluding":"1.4.5","matchCriteriaId":"3ABF5585-9632-4E5F-AD97-8C1777DA3F55"}]}]}],"references":[{"url":"https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/apptainer/apptainer/pull/3226","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm","source":"security-advisories@github.com","tags":["Not Applicable"]},{"url":"https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87","source":"security-advisories@github.com","tags":["Not Applicable"]}]}