« Volver al listado

CVE-2025-53945

Estado: AplazadaAlta (7)—

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Ficheros críticos con permisos 0666 (lectura/escritura global) en contenedores apko permiten escalada de privilegios local (AV:L, PR:L). Modificación de permisos es T1222.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementExecution PreventionApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Chainguard — ApkoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53945",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53945",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-22T15:03:34.863284Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 1.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "chainguard-dev",
          "product": "apko",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.27.0, < 0.29.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-18T16:15:30.020",
  "references": [
    {
      "url": "https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/releases/tag/v0.27.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/releases/tag/v0.29.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue."
    },
    {
      "lang": "es",
      "value": "apko permite a los usuarios crear y publicar imágenes de contenedores OCI a partir de paquetes APK. A partir de la versión 0.27.0 y anteriores a la 0.29.5, los archivos críticos se configuraban inadvertidamente como 0666, lo que podría utilizarse para escalar privilegios de root. La versión 0.29.5 incluye una solución para este problema."
    }
  ],
  "lastModified": "2026-06-17T09:39:10.453",
  "sourceIdentifier": "security-advisories@github.com"
}