PT-2025-30051 · Melange · Melange

Codyharris-H2O-Ai + 1 · Publicado 2025-07-18 · Atualizado 2025-08-04 · CVE-2025-54059

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions melange versions 0.23.0 through 0.29.4

Description melange allows users to build apk packages using declarative pipelines. SBOM files generated by melange in apks had file system permissions mode 666, potentially allowing an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a Denial of Service under special circumstances.

Recommendations Update to version 0.29.5 or later.

Exploit

Correção

DoS

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2025-54059

GHSA-5662-CV6M-63WH

GO-2025-3815

OPENSUSE-SU-2025:15405-1

Produtos afetados

Melange

Referências · 72

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54059.json · Exploit
• https://github.com/chainguard-dev/melange · Nota
• https://github.com/chainguard-dev/melange/pull/1836 · Nota
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh · Nota
• https://github.com/chainguard-dev/melange/pull/2086 · Nota
• https://github.com/chainguard-dev/melange/releases/tag/v0.29.5 · Nota
• https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04 · Nota
• https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1 · Nota
• https://github.com/chainguard-dev/melange/releases/tag/v0.23.0 · Nota
• https://suse.com/security/cve/CVE-2025-4563 · Nota
• https://suse.com/security/cve/CVE-2025-49825 · Nota
• https://suse.com/security/cve/CVE-2025-54379 · Nota
• https://suse.com/security/cve/CVE-2025-0928 · Nota
• https://suse.com/security/cve/CVE-2025-47281 · Nota
• https://suse.com/security/cve/CVE-2024-56731 · Nota