CVE-2025-65105

MEDIUM EPSS 8.9%
Published Dec 2, 20257mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Dec 2, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
8.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-61
CWE-706

Affected Products 1

VendorProductVersionRange
lfprojectsapptainer* <1.4.5

References 6

  • github.com https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981
    Patch
  • github.com https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2
    Patch
  • github.com https://github.com/apptainer/apptainer/pull/3226
    Issue Tracking
  • github.com https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j
    PatchVendor Advisory
  • github.com https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
    Not Applicable
  • github.com https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87
    Not Applicable

Remediation

  • github.com https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981
    Patch
  • github.com https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2
    Patch
  • github.com https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j
    PatchVendor Advisory