GHSA-J4RF-7357-F4CG Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

Impact There is an ext4 use-after-free flaw described in CVE-2022-1184 that is exploitable through versions of Apptainer 1.1.0 and installations that include apptainer-suid 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10...

CVE-2023-30549 Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer 1.1.0 and installations that include apptainer-suid 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterpri...

CVE-2023-30549 Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer 1.1.0 and installations that include apptainer-suid 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterpri...

PT-2023-22775 · Red Hat +1 · Red Hat +1

Name of the Vulnerable Software and Affected Versions: Apptainer versions prior to 1.1.0 Apptainer versions 1.1.0 through 1.1.7 with apptainer-suid versions prior to 1.1.8 Description: Apptainer is an open source container platform for Linux that contains an ext4 use-after-free flaw. This flaw ca...

Apptainer 资源管理错误漏洞

Apptainer is a Linux open source container platform from Apptainer Open Source. A resource management error vulnerability exists in versions of Apptainer prior to 1.1.8, which stems from the presence of a memory reuse after release issue. An attacker could exploit this vulnerability to cause a...

CVE-2023-30549

CVE-2023-30549 (Apptainer ext4 use-after-free) Affects Apptainer < 1.1.0 with apptainer-suid

CVE-2023-30549 Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer 1.1.0 and installations that include apptainer-suid 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterpri...

CVE-2023-30549

Removed by vendor...

Fedora: Security Advisory for apptainer (FEDORA-2023-677d58bb20)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for apptainer (FEDORA-2023-01ff262091)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: apptainer-1.1.6-1.fc36

Apptainer provides functionality to make portable containers that can be used across host environments...

[SECURITY] Fedora 37 Update: apptainer-1.1.6-1.fc37

Apptainer provides functionality to make portable containers that can be used across host environments...

OPENSUSE-SU-2023:0018-1 Security update for apptainer

This update for apptainer fixes the following issues: Updated to 1.1.2 which fixed CVE-2022-39237 CVE-2022-39237: The sif dependency included in Apptainer before this release does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. This release...

Security update for apptainer (moderate)

openSUSE Security Update: Security update for apptainer Announcement ID: openSUSE-SU-2023:0018-1 Rating: moderate References: Cross-References: CVE-2021-44716 CVE-2021-44717 CVE-2022-39237 CVSS scores: CVE-2021-44716 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44716 SUSE: 7.5...

Fedora 36 : apptainer (2022-0be906c02d)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-0be906c02d advisory. Update to 1.1.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 35 : apptainer (2022-2ff503c5d4)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2ff503c5d4 advisory. Update to 1.1.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora: Security Advisory for apptainer (FEDORA-2022-60c0d28bbd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: apptainer-1.1.3-1.fc37

Apptainer provides functionality to make portable containers that can be used across host environments...

GLSA-202210-19 : Apptainer: Lack of Digital Signature Hash Verification

The remote host is affected by the vulnerability described in GLSA-202210-19 Apptainer: Lack of Digital Signature Hash Verification - syslabs/sif is the Singularity Image Format SIF reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not veri...

Apptainer: Lack of Digital Signature Hash Verification

Background Apptainer is the container system for secure high-performance computing. Description The Go module "sif" version 2.8.0 and older, which is a statically linked dependency of Apptainer, does not verify that the hash algorithms used are cryptographically secure when verifying digital...