Listen to this Post
How the CVE Works:
Melange generates SBOM (Software Bill of Materials) files with insecure world-writable permissions (mode 666). This flaw, introduced in commit 1b272db, allows any unprivileged user on a running system to modify these files. Attackers can tamper with APK SBOMs, misleading security scanners or causing denial-of-service (DoS) under specific conditions. The issue stems from improper filesystem permission handling during APK builds, exposing critical metadata to unauthorized changes.
DailyCVE Form:
Platform: melange
Version: <0.29.5
Vulnerability: World-writable SBOM files
Severity: Moderate
Date: 2025-07-18
Prediction: Patch expected by 2025-07-25
What Undercode Say:
Check melange version: melange --version Verify SBOM file permissions: ls -l /var/lib/melange/sbom/ Mitigation command (pre-patch): chmod 644 /var/lib/melange/sbom/
How Exploit:
- Attacker modifies SBOM files to falsify dependencies.
- DoS via corruption of SBOM metadata.
Protection from this CVE:
- Upgrade to melange v0.29.5+.
- Manually set SBOM permissions to 644.
Impact:
- False security scan results.
- Potential supply chain attacks.
- Limited DoS scenarios.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
