The vulnerability arises from improper validation of the integrity check value (CWE-354) in melange and Apko. Specifically, the control section hash (e.g., .PKGINFO) was verified against the signed APKINDEX, but the data section hash, which covers the actual package files installed, was not validated. This gap enables an attacker with the ability to intercept or poison package sources to inject malicious or altered files without detection by the control hash verification. The flaw affects melange versions prior to 0.50.4 and Apko versions prior to 1.2.9. The vendor fixed the issue by adding verification of the data section hash in melange 0.50.4 and Apko 1.2.9.

An attacker who can compromise a package mirror, cache, or perform a man-in-the-middle attack can substitute arbitrary package file contents while still passing the control hash verification. This can lead to the installation of malicious or altered files, potentially resulting in complete compromise of systems relying on these packages. The CVSS score of 8.3 reflects high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade to melange version 0.50.4 or later and Apko version 1.2.9 or later to ensure proper validation of the data section hash. Applying these updates mitigates the vulnerability by verifying the integrity of the actual package files, preventing substitution attacks.