melange: Incomplete package integrity verification allows data section substitution

CAO 8.3CVE-2026-54174 · GHSA-fpg8-7664-jc5q · GO-2026-5968 · Công bố 11/09/2026 · cập nhật 30/09/2026

Tóm tắt nhanh

CVE-2026-54174 là lỗ hổng mức CAO (CVSS 8.3) ảnh hưởng chainguard.dev/apko, chainguard.dev/melange.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.15%, cao hơn 4.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.2.9, 0.50.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
chainguard.dev/apko Go	`< 1.2.9`	`1.2.9`
chainguard.dev/melange Go	`< 0.50.4`	`0.50.4`

Mô tả

Previously, Apko verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

Mô tả của NVD

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.