melange vulnerabilities

melange versions 0.32.0 through before 0.43.4 construct output file paths in --persist-lint-results by joining --out-dir with arch and pkgname from the APK's .PKGINFO without validating path separators or '..' sequences. An attacker supplying an APK to a melange lint/build pipeline could cause a JSON lint report to be written to an arbitrary reachable path. There is no direct code execution, but other JSON artifacts can be clobbered. The issue is fixed in 0.43.4.

melange (a tool for building apk packages using declarative pipelines) from version 0.32.0 to before 0.43.4 allows an attacker who can influence a melange configuration file to set pipeline[].uses to a value containing ../ sequences or an absolute path. The (*Compiled).compilePipeline function in pkg/build/compile.go passed uses directly to filepath.Join(pipelineDir, uses + ".yaml") without validation, so the resolved path could escape --pipeline-dir and read any YAML-parseable file visible to the melange process. Because the loaded file is interpreted as a melange pipeline and its runs: block is executed via /bin/sh -c in the build sandbox, this allowed shell commands from an out-of-tree file to run during the build, bypassing review. Fixed in melange v0.43.4 (commit 5829ca4).

Melange version 0.40.5 and earlier downloads URIs from build configs using io.Copy without any size limit or HTTP client timeout. An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk space on the build runner.