CVE-2025-65105
Medium · 4.5CVSS
4.5
EPSS
0.2%
Published
Dec 2, 2025
CISA due date
—
The record
Apptainer ineffective application of selinux and apparmor --security options
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/apptainer/apptainer | 0 | 1.4.5 |
| Go | github.com/opencontainers/runc | 0 | 1.2.8 |
| Go | github.com/opencontainers/runc | 1.3.0-rc.1 | 1.3.3 |
| Go | github.com/opencontainers/runc | 1.4.0-rc.1 | 1.4.0-rc.3 |
| Go | github.com/opencontainers/selinux | 0 | 1.13.0 |
| Go | github.com/sylabs/singularity/v4 | 0 | 4.1.11 |
| Go | github.com/sylabs/singularity/v4 | 4.2.0-rc.1 | 4.3.5 |
| SUSE:Linux Enterprise Module for HPC 15 SP7 | apptainer | 0 | 1.4.5-150600.4.12.1 |
| SUSE:Linux Enterprise Module for HPC 15 SP7 | squashfuse | 0 | 0.5.0-150600.3.2.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apptainer | 0 | 1.4.5-150600.4.12.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | squashfuse | 0 | 0.5.0-150600.3.2.1 |
| openSUSE:Leap 15.6 | apptainer | 0 | 1.4.5-150600.4.12.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| openSUSE:Leap 15.6 | squashfuse | 0 | 0.5.0-150600.3.2.1 |
| openSUSE:Tumbleweed | apptainer | 0 | 1.4.5-1.1 |
Related vulnerabilities
- GO-2025-4176 Apptainer ineffectively applies selinux and apparmor --security options in… Same vulnerability
- CVE-2025-64750 SingularityCE and SingularityPRO are open source container platforms. Also affects github.com/opencontainers/runc
- CVE-2025-52565 container escape due to /dev/console mount and related races Also affects github.com/opencontainers/runc
- CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions Also affects github.com/opencontainers/runc
- CVE-2025-52881 runc container escape and denial of service due to arbitrary write gadgets and procfs… Also affects github.com/opencontainers/runc
- CVE-2024-45310 runc is a CLI tool for spawning and running containers according to the OCI specification. Also affects github.com/opencontainers/runc
- CVE-2024-21626 runc is a CLI tool for spawning and running containers on Linux according to the OCI… Also affects github.com/opencontainers/runc
- GO-2025-4177 Singularity ineffectively applies of selinux / apparmor LSM process labels in… Also affects github.com/sylabs/singularity/v4