Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Previously, Apko verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.
Recommended action: Upgrade to 0.50.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact melange lint --persist-lint-results (opt-in flag, also usable via melange build --persist-lint-results) constructs output file paths by joining --out-dir with the arch and pkgname values read from the .PKGINFO control file of the APK being linted. In affected versions these values were not validated for path separators or .. sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write lint-<pkgname-<pkgver-r<epoch.json to an arbitrary .json path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass --persist-lint-results; the flag is off by default. Patches Fixed in melange v0.43.4 by validating arch and pkgname for .., /, and…
Recommended action: Upgrade to 0.43.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set pipeline[].uses to a value containing ../ sequences or an absolute path. The (Compiled).compilePipeline function in pkg/build/compile.go passed uses directly to filepath.Join(pipelineDir, uses + ".yaml") without validating the value, so the resolved path could escape each --pipeline-dir and read an arbitrary YAML-parseable file visible to the melange process. Because the loaded file is subsequently interpreted as a melange pipeline and its runs: block is executed via /bin/sh -c in the build sandbox, this additionally allowed shell commands sourced from an out-of-tree file to run during the build, bypassing the review boundary that normally covers the in-tree pipeline definition. Patches Fixed in melange v0.43.4 via commit 5829ca4. The fix rejects uses values that are absolute paths or contain .., and verifies (via filepath.Rel…
Recommended action: Upgrade to 0.43.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5. Fix: Merged Acknowledgements Thank you to Oleh Konko from 1seal for discovering and reporting this issue.
Recommended action: Upgrade to 0.43.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. Fix: Merged in commit 2f95c9f4 Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
Recommended action: Upgrade to 0.40.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process. Fix: Fixed in bd132535 , Released in 0.40.3. Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting…
Recommended action: Upgrade to 0.40.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.}} or ${{inputs.}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping. Fix: Fixed with e51ca30c, Released. Acknowledgements melange thanks Oleh Konko from 1seal for discovering and reporting this issue.
Recommended action: Upgrade to 0.40.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via ../ sequences. Fix: Fixed in 6e243d0d. Merged in release. Acknowledgements melange thanks Oleh Konko from 1seal for discovering and reporting this issue.
Recommended action: Upgrade to 0.40.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666: This issue was introduced in commit 1b272db ("Persist workspace filesystem throughout package builds (#1836)") (v0.23.0). Impact This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Patches This issue was addressed in melange in e29494b ("fix: tighten up permissions for written SBOM files and signature tarballs (#2086)") (v0.29.5). Acknowledgements Thanks to Cody Harris H2O.ai and Markus Boehme for independently reporting this issue.
Recommended action: Upgrade to 0.29.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.