openSUSE-SU-2026:21927-1
Security update for apptainer
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for apptainer fixes the following issues: Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666) - Fix * a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033), * a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236), * a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 16.0 | apptainer, apptainer-leap | 1.5.3-bp160.4.1 |
Mostrar las 2 entradas de 1 fuente
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 16.0 | apptainer | 1.5.3-bp160.4.1 |
| openSUSE Leap 16.0 | apptainer-leap | 1.5.3-bp160.4.1 |
Referencias
- https://bugzilla.suse.com/1278666
- https://bugzilla.suse.com/1279033
- https://bugzilla.suse.com/1279236
- https://bugzilla.suse.com/1279333
- https://www.suse.com/security/cve/CVE-2026-56854/
- https://www.suse.com/security/cve/CVE-2026-56855/
- https://www.suse.com/security/cve/CVE-2026-78662/
- https://www.suse.com/security/cve/CVE-2026-84303/