GO-2025-3816 apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko

apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko...

SUSE CVE-2025-53945

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the updateCache function in the buildimplementation.go file. An attacker can gain unauthorized access to modify critical system files by exploiting overly permissive file permissions. Remediation Upgrad...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the updateCache function in the buildimplementation.go file. An attacker can gain unauthorized access to modify critical system files by exploiting overly permissive file permissions. Remediation Upgrad...

PT-2025-30050 · Apko · Apko

Name of the Vulnerable Software and Affected Versions: apko versions 0.27.0 through 0.29.4 Description: apko is a tool that allows users to build and publish OCI container images built from apk packages. In versions prior to 0.29.5, critical files were inadvertently set to 0666, which could...

apko 安全漏洞

apko is an apk-based OCI image builder from apko open source. A security vulnerability exists in versions prior to apko 0.27.0 through 0.29.5, which stems from improperly set file permissions and may result in elevated privileges...

apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666: bash-5.3 find / -type f -perm -o+w /etc/ld.so.cache...

apko Exposure of HTTP basic auth credentials in log output

Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output Details There was a handful of instances where the apko tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The%s verb...

GHSA-V6MG-7F7P-QMQP apko Exposure of HTTP basic auth credentials in log output

Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output Details There was a handful of instances where the apko tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The%s verb...

SUSE CVE-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-36127

creationtimestamp| type| source ---|---|--- 2024-06-03 13:18:53+00:00| published-proof-of-concept| https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: tkn-fips, ko, melange, neuvector-sigstore-interface, policy-controller-fips, tekton-chains, policy-controller, wolfictl, skaffold, chainctl, ko-fips, aactl, tekton-chains-fips, zot, zarf, flux-source-controller, kubescape, gitsign, slsa-verifier, goreleaser, falcoctl...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: tkn, aactl, wolfictl, policy-controller, slsa-verifier, falcoctl, flux-source-controller, zot, tekton-chains, zarf, goreleaser, skaffold, vexctl, gitsign, kubescape, ko, spire-server, apko, neuvector-sigstore-interface, melange...

GHSA-88JX-383Q-W4QC vulnerabilities

Vulnerabilities for packages: tkn, aactl, wolfictl, policy-controller, slsa-verifier, falcoctl, flux-source-controller, zot, tekton-chains, zarf, goreleaser, skaffold, vexctl, gitsign, kubescape, ko, spire-server, apko, neuvector-sigstore-interface, melange...

CVE-2024-29903 vulnerabilities

Vulnerabilities for packages: tkn, aactl, wolfictl, policy-controller, slsa-verifier, falcoctl, flux-source-controller, zot, tekton-chains, zarf, goreleaser, skaffold, vexctl, gitsign, kubescape, ko, spire-server, apko, neuvector-sigstore-interface, melange...

CVE-2024-29903 vulnerabilities

Vulnerabilities for packages: tkn-fips, ko, melange, neuvector-sigstore-interface, policy-controller-fips, tekton-chains, policy-controller, wolfictl, skaffold, chainctl, ko-fips, aactl, tekton-chains-fips, zot, zarf, flux-source-controller, kubescape, gitsign, slsa-verifier, goreleaser, falcoctl...

CVE-2024-29902 vulnerabilities

Vulnerabilities for packages: tkn, aactl, wolfictl, policy-controller, slsa-verifier, falcoctl, flux-source-controller, zot, tekton-chains, zarf, goreleaser, skaffold, vexctl, gitsign, kubescape, ko, spire-server, apko, neuvector-sigstore-interface, melange...