openSUSE-SU-2026:21927-1
Security update for apptainer
Einstufung nach Quelle
Keine Quelle nennt einen CVSS-Wert.
Trivys eigenes Label ist CRITICAL. Kritisch laut SUSE.
Beschreibung
This update for apptainer fixes the following issues: Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666) - Fix * a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033), * a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236), * a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| openSUSE Leap 16.0 | apptainer, apptainer-leap | 1.5.3-bp160.4.1 |
Alle 2 Einträge aus 1 Quelle zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| openSUSE Leap 16.0 | apptainer | 1.5.3-bp160.4.1 |
| openSUSE Leap 16.0 | apptainer-leap | 1.5.3-bp160.4.1 |
Referenzen
- https://bugzilla.suse.com/1278666
- https://bugzilla.suse.com/1279033
- https://bugzilla.suse.com/1279236
- https://bugzilla.suse.com/1279333
- https://www.suse.com/security/cve/CVE-2026-56854/
- https://www.suse.com/security/cve/CVE-2026-56855/
- https://www.suse.com/security/cve/CVE-2026-78662/
- https://www.suse.com/security/cve/CVE-2026-84303/