GHSA-5662-cv6m-63wh

Source

https://github.com/advisories/GHSA-5662-cv6m-63wh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-5662-cv6m-63wh/GHSA-5662-cv6m-63wh.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-5662-cv6m-63wh

Aliases

CVE-2025-54059

Published

2025-07-18T20:13:21Z

Modified

2025-07-18T20:57:11.425472Z

Severity

4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator

Summary

melange's world-writable permissions expose SBOM files to potential image tampering

Details

It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666:

$ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest  | xargs wget -q -O  - | tar tzv 2>/dev/null var/lib/db/sbom
drwxr-xr-x root/root         0 2025-06-23 14:17 var/lib/db/sbom
-rw-rw-rw- root/root      3383 2025-06-23 14:17 var/lib/db/sbom/hello-wolfi-2.12.2-r1.spdx.json

This issue was introduced in commit 1b272db ("Persist workspace filesystem throughout package builds (#1836)") (v0.23.0).

Impact

This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances.

Patches

This issue was addressed in melange in e29494b ("fix: tighten up permissions for written SBOM files and signature tarballs (#2086)") (v0.29.5).

Acknowledgements

Thanks to Cody Harris H2O.ai and Markus Boehme for independently reporting this issue.

Database specific

{
    "severity": "MODERATE",
    "nvd_published_at": "2025-07-18T16:15:30Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-276"
    ],
    "github_reviewed_at": "2025-07-18T20:13:21Z"
}

References

Affected packages

Go / chainguard.dev/melange

Package

Name: chainguard.dev/melange; View open source insights on deps.dev
Purl: pkg:golang/chainguard.dev/melange

Affected ranges

Type: SEMVER
Events: Introduced

0.23.0

Fixed

0.29.5