[SECURITY] Fedora 44 Update: apptainer-1.5.4-1.fc44

Apptainer provides functionality to make portable containers that can be used across host environments...

[SECURITY] Fedora 43 Update: apptainer-1.5.4-1.fc43

Apptainer provides functionality to make portable containers that can be used across host environments...

[SECURITY] Fedora 45 Update: apptainer-1.5.4-1.fc45

Apptainer provides functionality to make portable containers that can be used across host environments...

Fedora 44 : apptainer (2026-e84de41d80)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e84de41d80 advisory. Update to upstream 1.5.4, including fix for high severity vulnerability GHSA-cr2j-534f-mf3g and for CVE-2026-41178. Tenable has extracted the preceding...

Fedora 43 : apptainer (2026-b38ba933a5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b38ba933a5 advisory. Update to upstream 1.5.4, including fix for high severity vulnerability GHSA-cr2j-534f-mf3g and for CVE-2026-41178. Tenable has extracted the preceding...

Fedora 45 : apptainer (2026-e4b8799ad3)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e4b8799ad3 advisory. Update to upstream 1.5.4, including fix for high severity vulnerability GHSA-cr2j-534f-mf3g and for CVE-2026-41178. Tenable has extracted the preceding...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21927-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21927-1 advisory. Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0...

Security update for apptainer (critical)

openSUSE security update: security update for apptainer ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21927-1 Rating: critical References: bsc1278666 bsc1279033 bsc1279236 bsc1279333 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662...

SUSE SLES15 Security Update : apptainer (SUSE-SU-2026:4308-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4308-1 advisory. - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278666. - CVE-2026-56855:...

Security update for apptainer

This update for apptainer fixes the following issues: CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278666. CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278666. CVE-2026-78662:...

SUSE-SU-2026:4308-1 Security update for apptainer

This update for apptainer fixes the following issues: - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278666. - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278666. - CVE-2026-78662:...

apptainer-1.5.3-4.1 on GA media (moderate)

apptainer-1.5.3-4.1 on GA media Announcement ID: openSUSE-SU-2026:11830-1 Rating: moderate Cross-References: CVE-2026-56854 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 CVSS scores: CVE-2026-56854 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2026-56854 SUSE : 8.6...

OPENSUSE-SU-2026:21927-1 Security update for apptainer

This update for apptainer fixes the following issues: Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 bsc1278666 - Fix a potential DoS via crash due to...

OPENSUSE-SU-2026:11830-1 apptainer-1.5.3-4.1 on GA media

These are all security issues fixed in the apptainer-1.5.3-4.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785

In Apptainer (open-source container platform) prior to v1.5.1 , the limit container paths directive in apptainer.conf uses plain string-prefix matching in Image.AuthorizedPath. This means an allowed path such as /data/safe also authorizes a sibling like /data/safe-but-unsafe, allowing a local use...