| Package | Affected versions | Patched versions |
|---|---|---|
| chainguard.dev/apko | < 1.2.7 | 1.2.7 |
DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. Affected versions <= 0.30.34.
Fix: No fix available yet.
Acknowledgements
apko thanks Oleh Konko from 1seal for discovering and reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free