apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

高 7.5CVE-2026-42575 · GHSA-hcwr-pq9g-rq3m · GO-2026-5422 · 09/05/2026 公開 · 24/07/2026 更新

要点

CVE-2026-42575 は chainguard.dev/apko に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.16%（全脆弱性の 5.1% より高い）。
対処：1.2.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
chainguard.dev/apko Go	`< 1.2.7`	`1.2.7`

概要

apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images.

Fix: No fix available yet.

Acknowledgements

apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

NVD の説明

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.