Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0439-1 advisory.

    Security fixes:

    - CVE-2024-45310: Fixed runc being tricked into creating empty       files/directories on host (bsc#1257432)
    - CVE-2025-65105: Fixed security bypass due to disabling security       options (bsc#1255462)
    - CVE-2025-47914: Fixed malformed constraint may cause denial of       service in golang.org/x/crypto/ssh/agent (bsc#1253967)
    - CVE-2025-58181: Fixed unbounded memory consumption in       golang.org/x/crypto/ssh (bsc#1253784)
    - CVE-2025-47913: Fixed potential denial of service in       golang.org/x/crypto/ssh/agent (bsc#1253506)
    - CVE-2025-22872: Fixed incorrect Neutralization of Input During       Web Page Generation in x/net (bsc#1241710)
    - CVE-2025-22870: Fixed HTTP Proxy bypass using IPv6 Zone IDs in       golang.org/x/net (bsc#1238611)
    - CVE-2025-22869: Fixed potential denial of service in       golang.org/x/crypto (bsc#1239322)
    - CVE-2025-27144: Fixed DoS in go-jose Parsing in       github.com/go-jose/go-jose (bsc#1237608)
    - CVE-2025-8556: Fixed missing and wrong validation can lead       to incorrect results in github.com/cloudflare/circl

    Other fixes:

    - Update to 1.4.5

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ff963b3775 advisory.

    Apply fuse2fs patches that were accidentally empty

    ----

    Update to upstream 1.4.5, including a fix for CVE-2025-65105

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-cf169a01e8 advisory.

    Apply fuse2fs patches that were accidentally empty

    ----

    Update to upstream 1.4.5, including a fix for CVE-2025-65105

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-df330356b2 advisory.

    Apply fuse2fs patches that were accidentally empty

    ----

    Update to upstream 1.4.5, including a fix for CVE-2025-65105

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can     disable two of the forms of the little used --security option, in particular the forms
    --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on     operations that containers can do. The --security option has always been mentioned in Apptainer     documentation as being a feature for the root user, although these forms do also work for unprivileged     users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-     based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends     on the distribution version. This vulnerability is fixed in 1.4.5. (CVE-2025-65105)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	high
298751	SUSE SLES15 / openSUSE 15 Security Update : apptainer (SUSE-SU-2026:0439-1)	Nessus	SuSE Local Security Checks	high
278585	Fedora 42 : apptainer (2025-ff963b3775)	Nessus	Fedora Local Security Checks	medium
278584	Fedora 43 : apptainer (2025-cf169a01e8)	Nessus	Fedora Local Security Checks	medium
278583	Fedora 41 : apptainer (2025-df330356b2)	Nessus	Fedora Local Security Checks	medium
277096	Linux Distros Unpatched Vulnerability : CVE-2025-65105	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-65105

medium

Tenable Plugins

high

high

medium

medium

medium

medium