Security update for apptainer SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:0066-1 Final 1 1 2025-01-10T14:49:12Z current 2025-01-10T14:49:12Z 2025-01-10T14:49:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apptainer This update for apptainer fixes the following issues: - Update to version 1.3.6 - CVE-2024-28180: Fixed an improper handling of highly compressed data in go-jose. (bsc#1235211) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-66,SUSE-SLE-Module-HPC-15-SP6-2025-66,openSUSE-SLE-15.6-2025-66 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20250066-1/ Link for SUSE-SU-2025:0066-1 https://lists.suse.com/pipermail/sle-security-updates/2025-January/020088.html E-Mail link for SUSE-SU-2025:0066-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1235211 SUSE Bug 1235211 https://www.suse.com/security/cve/CVE-2024-28180/ SUSE CVE CVE-2024-28180 page SUSE Linux Enterprise Module for HPC 15 SP6 openSUSE Leap 15.6 apptainer-1.3.6-150600.4.3.1 apptainer-leap-1.3.6-150600.4.3.1 apptainer-sle15_5-1.3.6-150600.4.3.1 apptainer-sle15_6-1.3.6-150600.4.3.1 apptainer-sle15_7-1.3.6-150600.4.3.1 apptainer-1.3.6-150600.4.3.1 as a component of SUSE Linux Enterprise Module for HPC 15 SP6 apptainer-sle15_6-1.3.6-150600.4.3.1 as a component of SUSE Linux Enterprise Module for HPC 15 SP6 apptainer-1.3.6-150600.4.3.1 as a component of openSUSE Leap 15.6 apptainer-leap-1.3.6-150600.4.3.1 as a component of openSUSE Leap 15.6 apptainer-sle15_5-1.3.6-150600.4.3.1 as a component of openSUSE Leap 15.6 apptainer-sle15_6-1.3.6-150600.4.3.1 as a component of openSUSE Leap 15.6 Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. CVE-2024-28180 SUSE Linux Enterprise Module for HPC 15 SP6:apptainer-1.3.6-150600.4.3.1 SUSE Linux Enterprise Module for HPC 15 SP6:apptainer-sle15_6-1.3.6-150600.4.3.1 openSUSE Leap 15.6:apptainer-1.3.6-150600.4.3.1 openSUSE Leap 15.6:apptainer-leap-1.3.6-150600.4.3.1 openSUSE Leap 15.6:apptainer-sle15_5-1.3.6-150600.4.3.1 openSUSE Leap 15.6:apptainer-sle15_6-1.3.6-150600.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20250066-1/ https://www.suse.com/security/cve/CVE-2024-28180.html CVE-2024-28180 https://bugzilla.suse.com/1234984 SUSE Bug 1234984