openSUSE-SU-2026:21927-1

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21927-1

Upstream

CVE (6)

Related

CVE (6)

Published

2026-09-21T13:53:22Z

Modified

2026-09-25T18:23:54Z

Summary

Security update for apptainer

Details

This update for apptainer fixes the following issues:

Changes in apptainer:

Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)
Fix
- a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),
- a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236),
- a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.3-bp160.4.1

{
    "binaries": [
        {
            "apptainer": "1.5.3-bp160.4.1",
            "apptainer-leap": "1.5.3-bp160.4.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21927-1.json"