https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:33:07 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-dp32029 <p><strong>Affected:</strong> CleanStart: melange</p> <p>CVE-2026-54174 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: melange</p> <p>CVE-2026-54174 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-dp32029 https://cve.radiocsirt.org/vuln/euvd-2026-367991 EUVD-2026-367991 https://cve.radiocsirt.org/vuln/euvd-2026-367991 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54174 <p>melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.</p> <p>melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54174 https://cve.radiocsirt.org/vuln/ghsa-fpg8-7664-jc5q <p><strong>Affected:</strong> Go: chainguard.dev/apko, Go: chainguard.dev/melange</p> <p>Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.</p> <p><strong>Affected:</strong> Go: chainguard.dev/apko, Go: chainguard.dev/melange</p> <p>Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.</p> https://cve.radiocsirt.org/vuln/ghsa-fpg8-7664-jc5q https://cve.radiocsirt.org/vuln/opensuse-su-2026:11829-1 <p>apko-1.4.4-1.1 on GA media</p> <p>apko-1.4.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11829-1