Most recent entries from all

CLEANSTART-2026-DP32029 — Security fix for CVE-2026-54174 applied in: melange 0.55.0-r1, melange 0.56.1-r1

2026-10-02T15:33:38.070125+00:00

Affected: CleanStart: melange

CVE-2026-54174 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-367991

2026-10-02T15:33:38.070183+00:00

EUVD-2026-367991

fkie_cve-2026-54174

2026-10-02T15:33:38.070199+00:00

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.

GHSA-fpg8-7664-jc5q — melange: Incomplete package integrity verification allows data section substitution

2026-10-02T15:33:38.070224+00:00

Affected: Go: chainguard.dev/apko, Go: chainguard.dev/melange

Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

openSUSE-SU-2026:11829-1 — apko-1.4.4-1.1 on GA media

2026-10-02T15:33:38.070248+00:00

apko-1.4.4-1.1 on GA media