Publish Advisories

advisory-database[bot] · advisory-database[bot] · commit 37f79bbbd869 · 2025-07-18T20:15:01.000Z
GHSA-25gv-mvm7-5h3h GHSA-5662-cv6m-63wh
diff --git a/advisories/github-reviewed/2022/11/GHSA-25gv-mvm7-5h3h/GHSA-25gv-mvm7-5h3h.json b/advisories/github-reviewed/2022/11/GHSA-25gv-mvm7-5h3h/GHSA-25gv-mvm7-5h3h.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-25gv-mvm7-5h3h",
-  "modified": "2025-04-29T15:37:21Z",
+  "modified": "2025-07-18T20:13:40Z",
   "published": "2022-11-25T18:30:25Z",
   "aliases": [
     "CVE-2022-45208"
@@ -18,7 +18,7 @@
     {
       "package": {
         "ecosystem": "Maven",
-        "name": "org.jeecgframework.boot:jeecg-boot-common"
+        "name": "org.jeecgframework.boot:jeecg-module-system"
       },
       "ranges": [
         {
diff --git a/advisories/github-reviewed/2025/07/GHSA-5662-cv6m-63wh/GHSA-5662-cv6m-63wh.json b/advisories/github-reviewed/2025/07/GHSA-5662-cv6m-63wh/GHSA-5662-cv6m-63wh.json
@@ -0,0 +1,81 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5662-cv6m-63wh",
+  "modified": "2025-07-18T20:13:21Z",
+  "published": "2025-07-18T20:13:21Z",
+  "aliases": [
+    "CVE-2025-54059"
+  ],
+  "summary": "melange's world-writable permissions expose SBOM files to potential image tampering",
+  "details": "It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666:\n```\n$ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest  | xargs wget -q -O  - | tar tzv 2>/dev/null var/lib/db/sbom\ndrwxr-xr-x root/root         0 2025-06-23 14:17 var/lib/db/sbom\n-rw-rw-rw- root/root      3383 2025-06-23 14:17 var/lib/db/sbom/hello-wolfi-2.12.2-r1.spdx.json\n```\n\nThis issue was introduced in commit 1b272db (\"Persist workspace filesystem throughout package builds (#1836)\") ([v0.23.0](https://github.com/chainguard-dev/melange/releases/tag/v0.23.0)).\n\n### Impact\nThis potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances.\n\n### Patches\nThis issue was addressed in melange in e29494b (\"fix: tighten up permissions for written SBOM files and signature tarballs (#2086)\") ([v0.29.5](https://github.com/chainguard-dev/melange/releases/tag/v0.29.5)).\n\n## Acknowledgements\n\nThanks to Cody Harris [H2O.ai](https://h2o.ai/) and Markus Boehme for independently reporting this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "chainguard.dev/melange"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.23.0"
+            },
+            {
+              "fixed": "0.29.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54059"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chainguard-dev/melange/pull/1836"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chainguard-dev/melange/pull/2086"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/chainguard-dev/melange"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chainguard-dev/melange/releases/tag/v0.29.5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-276"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-07-18T20:13:21Z",
+    "nvd_published_at": "2025-07-18T16:15:30Z"
+  }
+}

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"schema_version": "1.4.0",`
`3`	`3`	`"id": "GHSA-25gv-mvm7-5h3h",`
`4`		`- "modified": "2025-04-29T15:37:21Z",`
	`4`	`+ "modified": "2025-07-18T20:13:40Z",`
`5`	`5`	`"published": "2022-11-25T18:30:25Z",`
`6`	`6`	`"aliases": [`
`7`	`7`	`"CVE-2022-45208"`
`@@ -18,7 +18,7 @@`
`18`	`18`	`{`
`19`	`19`	`"package": {`
`20`	`20`	`"ecosystem": "Maven",`
`21`		`- "name": "org.jeecgframework.boot:jeecg-boot-common"`
	`21`	`+ "name": "org.jeecgframework.boot:jeecg-module-system"`
`22`	`22`	`},`
`23`	`23`	`"ranges": [`
`24`	`24`	`{`