CVE-2025-54059

melange creates SBOM files in APKs with world-writable permissions

CVSS 4.4 MEDIUMEPSS 0.1%CWE-276

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.4EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

18 jul 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Produtos afetados

chainguard-dev · melange

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04 https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1 https://github.com/chainguard-dev/melange/pull/1836 https://github.com/chainguard-dev/melange/pull/2086 https://github.com/chainguard-dev/melange/releases/tag/v0.23.0 https://github.com/chainguard-dev/melange/releases/tag/v0.29.5 https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh