Security update for apptainer
This update for apptainer fixes the following issues: Security fixes: - CVE-2024-45310: Fixed runc being tricked into creating empty files/directories on host (bsc#1257432) - CVE-2025-65105: Fixed security bypass due to disabling security options (bsc#1255462) - CVE-2025-47914: Fixed malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent (bsc#1253967) - CVE-2025-58181: Fixed unbounded memory consumption in golang.org/x/crypto/ssh (bsc#1253784) - CVE-2025-47913: Fixed potential denial of service in golang.org/x/crypto/ssh/agent (bsc#1253506) - CVE-2025-22872: Fixed incorrect Neutralization of Input During Web Page Generation in x/net (bsc#1241710) - CVE-2025-22870: Fixed HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (bsc#1238611) - CVE-2025-22869: Fixed potential denial of service in golang.org/x/crypto (bsc#1239322) - CVE-2025-27144: Fixed DoS in go-jose Parsing in github.com/go-jose/go-jose (bsc#1237608) - CVE-2025-8556: Fixed missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl Other fixes: - Update to 1.4.5
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for apptainer fixes the following issues: Security fixes: - CVE-2024-45310: Fixed runc being tricked into creating empty files/directories on host (bsc#1257432) - CVE-2025-65105: Fixed security bypass due to disabling security options (bsc#1255462) - CVE-2025-47914: Fixed malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent (bsc#1253967) - CVE-2025-58181: Fixed unbounded memory consumption in golang.org/x/crypto/ssh (bsc#1253784) - CVE-2025-47913: Fixed potential denial of service in golang.org/x/crypto/ssh/agent (bsc#1253506) - CVE-2025-22872: Fixed incorrect Neutralization of Input During Web Page Generation in x/net (bsc#1241710) - CVE-2025-22870: Fixed HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (bsc#1238611) - CVE-2025-22869: Fixed potential denial of service in golang.org/x/crypto (bsc#1239322) - CVE-2025-27144: Fixed DoS in go-jose Parsing in github.com/go-jose/go-jose (bsc#1237608) - CVE-2025-8556: Fixed missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl Other fixes: - Update to 1.4.5
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1237608
- https://bugzilla.suse.com/1238611
- https://bugzilla.suse.com/1239322
- https://bugzilla.suse.com/1241710
- https://bugzilla.suse.com/1253506
- https://bugzilla.suse.com/1253784
- https://bugzilla.suse.com/1253967
- https://bugzilla.suse.com/1255462
- https://bugzilla.suse.com/1257432
- https://www.suse.com/security/cve/CVE-2024-45310
- https://www.suse.com/security/cve/CVE-2025-22869
- https://www.suse.com/security/cve/CVE-2025-22870
- https://www.suse.com/security/cve/CVE-2025-22872
- https://www.suse.com/security/cve/CVE-2025-27144
- https://www.suse.com/security/cve/CVE-2025-47913
- https://www.suse.com/security/cve/CVE-2025-47914
- https://www.suse.com/security/cve/CVE-2025-58181
- https://www.suse.com/security/cve/CVE-2025-65105
- https://www.suse.com/security/cve/CVE-2025-8556
- https://www.suse.com/support/update/announcement/2026/suse-su-20260439-1/