chainguard.dev/apko vulnerabilities (Go)
9 vulnerabilities.
-
chainguard.dev/apkoGo melange: Incomplete package integrity verification allows data section substitution 8.3 High -
chainguard.dev/apkoGo apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) 7.5 High -
chainguard.dev/apkoGo apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root 7.5 High -
chainguard.dev/apkoGo apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery 6.5 Medium -
chainguard.dev/apkoGo apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams 7.5 High -
chainguard.dev/apkoGo apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams 5.5 Medium -
chainguard.dev/apkoGo apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base 7.5 High -
chainguard.dev/apkoGo apko has incorrect permission (0666) in /etc/ld.so.cache and other files 7.0 High -
chainguard.dev/apkoGo apko Exposure of HTTP basic auth credentials in log output 7.5 High