SUSE SLES15 Security Update : apptainer (SUSE-SU-2026:2609-1)

high Nessus Plugin ID 323089

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2609-1 advisory.

This update for apptainer fixes the following issues

- CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1264177).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
path pseudo- header (bsc#1260311).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265844).
- CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262956).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266656).
- CVE-2026-39827: memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-39828: bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-39829: pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-39830: client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-39831: bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-39832: agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266202).
- CVE-2026-39833: key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266202).
- CVE-2026-39834: infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-39835: server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-42508: auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266202).
- CVE-2026-46595: VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-46597: byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266202).
- CVE-2026-46598: pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266202).
- CVE-2026-48785: incorrect path matching for limit container paths directive (bsc#1267982).

Changes for apptainer:

- Update apptainer to version v1.5.1

* Work around segmentation fault sometimes seen while `mksquashfs` under proot is creating a SIF file.
* Update bundled PRoot to version 5.4.0-rootless.3 in order to fix a problem where SIF files could be corrupted when `mksquashfs` died with a signal. The proot command was not passing back an error exit code.
* Updated bundled `squashfuse_ll` to version 0.6.2 in order to fix a crash sometimes seen with apptainer in unprivileged docker.
* Update bundled fuse2fs to version 1.47.4 instead of patching the bugs in 1.47.3.
* Fix a crash that happened when `/etc/resolv.conf` was a symlink while building from a definition file using the localimage bootstrap.
* Support hosts that have an /etc/resolv.conf symlink pointing to `../run` in addition to `/run`.
* Change the download-dependencies script to skip downloading the PRoot source code on architectures that it is known to not support (that is: ppc*, s390*, and riscv*).
In those situations Apptainer will skip trying to compile and run proot. As a result original owners and groups of files will not be preserved in SIF images built by unprivileged users, as was the case for all architectures prior to 1.5.0.
* Fix panic encountered during progress bar update while pulling image.
* Fix fakeroot overwriting root's username in `/etc/passwd` with the host user's name, a regression introduced in v1.5.0.
* Add nonested flag for --mount specifications to prevent individual bind mounts from being passed to nested containers via `APPTAINER_BIND`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected apptainer, apptainer-sle15_6 and / or apptainer-sle15_7 packages.

Plugin Details

Severity: High

ID: 323089

File Name: suse_SU-2026-2609-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 6/26/2026

Updated: 6/26/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, tenable_cloud_security, tenable_self_hosted_container_security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-33814

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:apptainer, p-cpe:/a:novell:suse_linux:apptainer-sle15_6, p-cpe:/a:novell:suse_linux:apptainer-sle15_7, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/24/2026

Vulnerability Publication Date: 1/22/2026

Reference Information

CVE: CVE-2026-24137, CVE-2026-33186, CVE-2026-33814, CVE-2026-34986, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, CVE-2026-48785

SuSE: SUSE-SU-2026:2609-1

Detections

Analytics

SUSE SLES15 Security Update : apptainer (SUSE-SU-2026:2609-1)

high Nessus Plugin ID 323089

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

Vulnerability Information

Reference Information