apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

中 6.5CVE-2026-42576 · GHSA-m7hm-vm4x-28jf · GO-2026-5497 · 09/05/2026 公開 · 24/07/2026 更新

要点

CVE-2026-42576 は chainguard.dev/apko に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.25%（全脆弱性の 16.8% より高い）。
対処：1.2.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
chainguard.dev/apko Go	`< 1.2.7`	`1.2.7`

概要

DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. Affected versions <= 0.30.34.

Fix: No fix available yet.

Acknowledgements

apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

NVD の説明

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.