Security Advisories for chainguard.dev/melange in go
High
about 2 months ago
melange: Incomplete package integrity verification allows data section substitution
go
chainguard.dev/melange, chainguard.dev/apko
Low
4 months ago
melange has Path Traversal via .PKGINFO in --persist-lint-results
go
chainguard.dev/melange
Moderate
4 months ago
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
go
chainguard.dev/melange
Moderate
6 months ago
`melange update-cache` has unbounded HTTP download that can exhaust disk in CI
go
chainguard.dev/melange
Moderate
7 months ago
melange has a path traversal in license-path which allows reading files outside workspace
go
chainguard.dev/melange
High
7 months ago
melange affected by potential host command execution via license-check YAML mode patch pipeline
go
chainguard.dev/melange
High
7 months ago
melange pipeline working-directory could allow command injection
go
chainguard.dev/melange
High
7 months ago
melange QEMU runner could write files outside workspace directory
go
chainguard.dev/melange
Moderate
about 1 year ago
melange's world-writable permissions expose SBOM files to potential image tampering
go
chainguard.dev/melange