CVE-2025-65105 Details
Description
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
A vulnerability exists in Apptainer versions prior to 1.4.5, allowing containers to disable certain aspects of the '--security' option, specifically '--security=apparmor:<profile>' and '--security=selinux:<label>'. These options are intended to restrict container operations. While the '--security' option is primarily for root users, it can also be used by unprivileged users if the relevant features are enabled on their system. The vulnerability arises because the application of SELinux labels can be misdirected, leaving processes unprotected, and warnings about unavailable security features may be overlooked when Apptainer is run from scripts or automation.
Users can update to Apptainer version 1.4.5 or later, where this vulnerability has been addressed. For versions 4.1.11 and 4.3.5, this vulnerability has also been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lfprojects apptainer | < 1.4.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 5, 2025 | Initial Analysis | [email protected] |
| Dec 2, 2025 | New CVE Received | [email protected] |