openSUSE-SU-2026:21927-1
Security update for apptainer
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for apptainer fixes the following issues: Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666) - Fix * a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033), * a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236), * a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 16.0 | apptainer, apptainer-leap | 1.5.3-bp160.4.1 |
Show all 2 entries from 1 source
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 16.0 | apptainer | 1.5.3-bp160.4.1 |
| openSUSE Leap 16.0 | apptainer-leap | 1.5.3-bp160.4.1 |
References
- https://bugzilla.suse.com/1278666
- https://bugzilla.suse.com/1279033
- https://bugzilla.suse.com/1279236
- https://bugzilla.suse.com/1279333
- https://www.suse.com/security/cve/CVE-2026-56854/
- https://www.suse.com/security/cve/CVE-2026-56855/
- https://www.suse.com/security/cve/CVE-2026-78662/
- https://www.suse.com/security/cve/CVE-2026-84303/