chainguard-dev/melange · Security
melange: Incomplete package integrity verification allows data section substitution
- GHSA ID
- GHSA-fpg8-7664-jc5q
- CVE ID
- CVE-2026-54174
- Severity
- high
- Published
- Updated
- CVSS
- 8.3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 8.3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Previously, Apko verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.
CWEs
- CWE-345 · Insufficient Verification of Data Authenticity
- CWE-354 · Improper Validation of Integrity Check Value