### Impact The `limit container paths directive` in `apptainer.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in /data/safe-but-unsafe to be run. ### Patches The issue is patched in apptainer version 1.5.1. ### Workarounds If developers do not use setuid mode or do not use the `limit container paths` functionality, then this issue does not affect their installation. Note that, as documented [1], if user namespaces are allowed for unrestricted use then this functionality does not stop users from running any container of their choice. If developers do use the `limit container paths` functionality they are advised to update. ### Credit This vulnerability was discovered and disclosed to the Apptainer project by Dave Trudgian of Sylabs. ### Resources [1] https://apptainer.org/docs/admin/latest/configfiles.html#limiting-container-execution
### Impact The `limit container paths directive` in `apptainer.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in /data/safe-but-unsafe to be run. ### Patches The issue is patched in apptainer version 1.5.1. ### Workarounds If developers do not use setuid mode or do not use the `limit container paths` functionality, then this issue does not affect their installation. Note that, as documented [1], if user namespaces are allowed for unrestricted use then this functionality does not stop users from running any container of their choice. If developers do use the `limit container paths` functionality they are advised to update. ### Credit This vulnerability was discovered and disclosed to the Apptainer project by Dave Trudgian of Sylabs. ### Resources [1] https://apptainer.org/docs/admin/latest/configfiles.html#limiting-container-execution
Update github.com/apptainer/apptainer to 1.5.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanApptainer has incorrect path matching for 'limit container paths' directive affects github.com/apptainer/apptainer (go). Severity is medium. ### Impact The `limit container paths directive` in `apptainer.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in /data/safe-but-unsafe to be run. ### Patches The issue is patched in apptainer version 1.5.1. ### Workarounds If developers do not use setuid mode or do not use the `limit container paths` functionality, then this issue does not affect their installation. Note that, as documented [1], if user namespaces are allowed for unrestricted use then this functionality does not stop users from running any container of their choice. If developers do use the `limit container paths` functionality they are advised to update. ### Credit This vulnerability was discovered and disclosed to the Apptainer project by Dave Trudgian of Sylabs. ### Resources [1] https://apptainer.org/docs/admin/latest/configfiles.html#limiting-container-execution
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/apptainer/apptainergo | <1.5.1 | 1.5.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/apptainer/apptainer to 1.5.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanApptainer has incorrect path matching for 'limit container paths' directive affects github.com/apptainer/apptainer (go). Severity is medium. ### Impact The `limit container paths directive` in `apptainer.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in /data/safe-but-unsafe to be run. ### Patches The issue is patched in apptainer version 1.5.1. ### Workarounds If developers do not use setuid mode or do not use the `limit container paths` functionality, then this issue does not affect their installation. Note that, as documented [1], if user namespaces are allowed for unrestricted use then this functionality does not stop users from running any container of their choice. If developers do use the `limit container paths` functionality they are advised to update. ### Credit This vulnerability was discovered and disclosed to the Apptainer project by Dave Trudgian of Sylabs. ### Resources [1] https://apptainer.org/docs/admin/latest/configfiles.html#limiting-container-execution
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/apptainer/apptainergo | <1.5.1 | 1.5.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard