Vulnerability · Published Dec 2, 2025 · Assigned by GitHub_M
CVE-2025-65105Apptainer ineffective application of selinux and apparmor --security options
Medium 4.5
In plain English
A medium-severity security flaw in apptainer from apptainer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | apptainer | 1.4.5-r0 | ALPINE-CVE-2025-65105 |
| Alpine:v3.24 | apptainer | 1.4.5-r0 | ALPINE-CVE-2025-65105 |
| Debian:14 | apptainer | 1.4.5-1 | DEBIAN-CVE-2025-65105 |
| Go | github.com/apptainer/apptainer | 1.4.5 | GO-2025-4176 |
| Go | github.com/apptainer/apptainer | 1.4.5 | GHSA-j3rw-fx6g-q46j |
| Ubuntu:25.10 | apptainer | no fix listed | UBUNTU-CVE-2025-65105 |
| Ubuntu:26.04:LTS | apptainer | no fix listed | UBUNTU-CVE-2025-65105 |
| Ubuntu:26.10 | apptainer | no fix listed | UBUNTU-CVE-2025-65105 |
Affected products (as reported)
Weakness: CWE-61, CWE-706 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j x_refsource_CONFIRM
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm x_refsource_MISC
- https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 x_refsource_MISC
- https://github.com/apptainer/apptainer/pull/3226 x_refsource_MISC
- https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981 x_refsource_MISC
- https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2 x_refsource_MISC