SB2025100767 - Fedora 42 update for apptainer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025100767

SB2025100767 - Fedora 42 update for apptainer

Published: October 7, 2025

Security Bulletin ID SB2025100767
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Memory leak (CVE-ID: CVE-2025-58058)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due memory leak when decoding corrupted LZMA archives. A remote attacker can force the application to leak memory and perform denial of service attack.


2) Protection Mechanism Failure (CVE-ID: CVE-2025-47910)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in http.CrossOriginProtection. The AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. An attacker can bypass implemented security restrictions.


Remediation

Install update from vendor's website.

References