Vulnerability-Lookup

CVE-2025-54059 (GCVE-0-2025-54059)

Vulnerability from cvelistv5 – Published: 2025-07-18 15:40 – Updated: 2025-07-18 16:04

Title

melange creates SBOM files in APKs with world-writable permissions

Summary

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-18 15:53 UTC

CWE

CWE-276 - Incorrect Default Permissions

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/chainguard-dev/melange/securit…	x_refsource_CONFIRM
https://github.com/chainguard-dev/melange/pull/1836	x_refsource_MISC
https://github.com/chainguard-dev/melange/pull/2086	x_refsource_MISC
https://github.com/chainguard-dev/melange/commit/…	x_refsource_MISC
https://github.com/chainguard-dev/melange/commit/…	x_refsource_MISC
https://github.com/chainguard-dev/melange/release…	x_refsource_MISC
https://github.com/chainguard-dev/melange/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
chainguard-dev	melange	Affected: >= 0.23.0, < 0.29.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54059",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T15:53:51.678522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-18T16:04:30.154Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "melange",
          "vendor": "chainguard-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.29.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-18T15:40:43.277Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh"
        },
        {
          "name": "https://github.com/chainguard-dev/melange/pull/1836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chainguard-dev/melange/pull/1836"
        },
        {
          "name": "https://github.com/chainguard-dev/melange/pull/2086",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chainguard-dev/melange/pull/2086"
        },
        {
          "name": "https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04"
        },
        {
          "name": "https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1"
        },
        {
          "name": "https://github.com/chainguard-dev/melange/releases/tag/v0.23.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chainguard-dev/melange/releases/tag/v0.23.0"
        },
        {
          "name": "https://github.com/chainguard-dev/melange/releases/tag/v0.29.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chainguard-dev/melange/releases/tag/v0.29.5"
        }
      ],
      "source": {
        "advisory": "GHSA-5662-cv6m-63wh",
        "discovery": "UNKNOWN"
      },
      "title": "melange creates SBOM files in APKs with world-writable permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54059",
    "datePublished": "2025-07-18T15:40:43.277Z",
    "dateReserved": "2025-07-16T13:22:18.203Z",
    "dateUpdated": "2025-07-18T16:04:30.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-54059",
      "date": "2026-09-15",
      "epss": "0.00129",
      "percentile": "0.02891"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-54059\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-07-18T16:15:30.180\",\"lastModified\":\"2026-06-17T09:39:20.900\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Melange permite a los usuarios crear paquetes APK mediante pipelines declarativos. A partir de la versi\u00f3n 0.23.0 y anteriores a la 0.29.5, los archivos SBOM generados por Melange en APK ten\u00edan permisos de sistema de archivos en modo 666. Esto podr\u00eda permitir que un usuario sin privilegios altere los SBOM de APK en una imagen en ejecuci\u00f3n, lo que podr\u00eda confundir a los esc\u00e1neres de seguridad. Un atacante tambi\u00e9n podr\u00eda realizar un ataque de DoS en circunstancias especiales. La versi\u00f3n 0.29.5 corrige el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"chainguard-dev\",\"product\":\"melange\",\"versions\":[{\"version\":\"\u003e= 0.23.0, \u003c 0.29.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-07-18T15:53:51.678522Z\",\"id\":\"CVE-2025-54059\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"references\":[{\"url\":\"https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/chainguard-dev/melange/pull/1836\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/chainguard-dev/melange/pull/2086\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/chainguard-dev/melange/releases/tag/v0.23.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/chainguard-dev/melange/releases/tag/v0.29.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-07-20T15:50:49+00:00",
      "cve": "CVE-2025-54059",
      "id": "CVE-2025-54059",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "melange creates SBOM files in APKs with world-writable permissions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-54059.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-25T01:49:25Z",
      "cve": "CVE-2025-54059",
      "id": "CVE-2025-54059",
      "initial_release_date": "2025-07-19T23:21:04Z",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-54059",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-54059.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-54059\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-18T15:53:51.678522Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-18T15:53:59.807Z\"}}], \"cna\": {\"title\": \"melange creates SBOM files in APKs with world-writable permissions\", \"source\": {\"advisory\": \"GHSA-5662-cv6m-63wh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"chainguard-dev\", \"product\": \"melange\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.23.0, \u003c 0.29.5\"}]}], \"references\": [{\"url\": \"https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh\", \"name\": \"https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/chainguard-dev/melange/pull/1836\", \"name\": \"https://github.com/chainguard-dev/melange/pull/1836\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chainguard-dev/melange/pull/2086\", \"name\": \"https://github.com/chainguard-dev/melange/pull/2086\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04\", \"name\": \"https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1\", \"name\": \"https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chainguard-dev/melange/releases/tag/v0.23.0\", \"name\": \"https://github.com/chainguard-dev/melange/releases/tag/v0.23.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/chainguard-dev/melange/releases/tag/v0.29.5\", \"name\": \"https://github.com/chainguard-dev/melange/releases/tag/v0.29.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276: Incorrect Default Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-07-18T15:40:43.277Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-54059\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-18T16:04:30.154Z\", \"dateReserved\": \"2025-07-16T13:22:18.203Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-07-18T15:40:43.277Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-54059

Vulnerability from fkie_nvd - Published: 2025-07-18 16:15 - Updated: 2026-06-17 09:39

Severity

4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04
	security-advisories@github.com	https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1
	security-advisories@github.com	https://github.com/chainguard-dev/melange/pull/1836
	security-advisories@github.com	https://github.com/chainguard-dev/melange/pull/2086
	security-advisories@github.com	https://github.com/chainguard-dev/melange/releases/tag/v0.23.0
	security-advisories@github.com	https://github.com/chainguard-dev/melange/releases/tag/v0.29.5
	security-advisories@github.com	https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "melange",
          "vendor": "chainguard-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.29.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Melange permite a los usuarios crear paquetes APK mediante pipelines declarativos. A partir de la versi\u00f3n 0.23.0 y anteriores a la 0.29.5, los archivos SBOM generados por Melange en APK ten\u00edan permisos de sistema de archivos en modo 666. Esto podr\u00eda permitir que un usuario sin privilegios altere los SBOM de APK en una imagen en ejecuci\u00f3n, lo que podr\u00eda confundir a los esc\u00e1neres de seguridad. Un atacante tambi\u00e9n podr\u00eda realizar un ataque de DoS en circunstancias especiales. La versi\u00f3n 0.29.5 corrige el problema."
    }
  ],
  "id": "CVE-2025-54059",
  "lastModified": "2026-06-17T09:39:20.900",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54059",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-18T15:53:51.678522Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-18T16:15:30.180",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/pull/1836"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/pull/2086"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/releases/tag/v0.23.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/releases/tag/v0.29.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5662-CV6M-63WH

Vulnerability from github – Published: 2025-07-18 20:13 – Updated: 2025-07-18 20:13

Summary

melange's world-writable permissions expose SBOM files to potential image tampering

Details

It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666:

$ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest  | xargs wget -q -O  - | tar tzv 2>/dev/null var/lib/db/sbom
drwxr-xr-x root/root         0 2025-06-23 14:17 var/lib/db/sbom
-rw-rw-rw- root/root      3383 2025-06-23 14:17 var/lib/db/sbom/hello-wolfi-2.12.2-r1.spdx.json

This issue was introduced in commit 1b272db ("Persist workspace filesystem throughout package builds (#1836)") (v0.23.0).

Impact

This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances.

Patches

This issue was addressed in melange in e29494b ("fix: tighten up permissions for written SBOM files and signature tarballs (#2086)") (v0.29.5).

Acknowledgements

Thanks to Cody Harris H2O.ai and Markus Boehme for independently reporting this issue.

Severity

4.4 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "chainguard.dev/melange"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.29.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-18T20:13:21Z",
    "nvd_published_at": "2025-07-18T16:15:30Z",
    "severity": "MODERATE"
  },
  "details": "It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666:\n```\n$ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest  | xargs wget -q -O  - | tar tzv 2\u003e/dev/null var/lib/db/sbom\ndrwxr-xr-x root/root         0 2025-06-23 14:17 var/lib/db/sbom\n-rw-rw-rw- root/root      3383 2025-06-23 14:17 var/lib/db/sbom/hello-wolfi-2.12.2-r1.spdx.json\n```\n\nThis issue was introduced in commit 1b272db (\"Persist workspace filesystem throughout package builds (#1836)\") ([v0.23.0](https://github.com/chainguard-dev/melange/releases/tag/v0.23.0)).\n\n### Impact\nThis potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances.\n\n### Patches\nThis issue was addressed in melange in e29494b (\"fix: tighten up permissions for written SBOM files and signature tarballs (#2086)\") ([v0.29.5](https://github.com/chainguard-dev/melange/releases/tag/v0.29.5)).\n\n## Acknowledgements\n\nThanks to Cody Harris [H2O.ai](https://h2o.ai/) and Markus Boehme for independently reporting this issue.",
  "id": "GHSA-5662-cv6m-63wh",
  "modified": "2025-07-18T20:13:21Z",
  "published": "2025-07-18T20:13:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54059"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/melange/pull/1836"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/melange/pull/2086"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/chainguard-dev/melange"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chainguard-dev/melange/releases/tag/v0.29.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "melange\u0027s world-writable permissions expose SBOM files to potential image tampering"
}

OPENSUSE-SU-2025:15405-1

Vulnerability from csaf_opensuse - Published: 2025-08-04 00:00 - Updated: 2025-08-04 00:00

Summary

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

Severity

Moderate

Scope

56 vulnerabilities in this advisory, including CVE-2025-54059.

CVE-2025-54059

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-54059 (GCVE-0-2025-54059)

FKIE_CVE-2025-54059

GHSA-5662-CV6M-63WH

Impact

Patches

Acknowledgements

OPENSUSE-SU-2025:15405-1

Tags

Sightings

Nomenclature