CVE-2026-54174: fallo de gravedad alta en chainguard-dev melange
melange: Incomplete package integrity verification allows data section substitution
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.2%
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVEs relacionadas — chainguard-dev melange
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-36127HIGHapko Exposure of HTTP basic auth credentials in log outputEPSS 0.4%CVE-2026-25121HIGHapko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside baseEPSS 0.4%CVE-2026-25140HIGHapko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streamsEPSS 0.4%CVE-2026-42574HIGHapko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootEPSS 0.4%CVE-2026-105768MEDIUMapko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as rootEPSS 0.3%CVE-2026-29049MEDIUMmelange: unbounded HTTP download in `melange update-cache` can exhaust disk in CIEPSS 0.3%