Homepage

Incorrect Default Permissions Affecting cg package, versions <0_git20250730-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.01% (2nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Incorrect Default Permissions vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CHAINGUARDLATEST-CG-11339638
  • published30 Jul 2025
  • disclosed18 Jul 2025
Report a new vulnerability Found a mistake?

Introduced: 18 Jul 2025

CVE-2025-54059  (opens in a new tab)
CWE-276  (opens in a new tab)

How to fix?

Upgrade Chainguard cg to version 0_git20250730-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cg package and not the cg package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.