melange/0.13.3 package update

[octo-sts]

[github-actions]

Package melange-microvm-init: Click to expand/collapse

Package melange-microvm-init:
Unchanged

Package melange: Click to expand/collapse

Package melange:
Modified: /usr/bin/melange

malcontent found differences: Click to expand/collapse

Deleted: melange/var/lib/db/sbom/melange-0.13.1-r0.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
-MEDIUM	net/download	download files	downloadLocation
-LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/f7272cc16492a845a6bc1973e232

Added: melange/var/lib/db/sbom/melange-0.13.3-r0.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
+MEDIUM	net/download	download files	downloadLocation
+LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/5b1f9ea48198f45ce704fca21203

Changed: /tmp/wolfictl-apk-3885527745/melange-microvm-init/init

Changed: /tmp/wolfictl-apk-3885527745/melange/usr/bin/melange

Moved: melange-microvm-init/var/lib/db/sbom/melange-microvm-init-0.13.1-r0.spdx.json -> /tmp/wolfictl-apk-3885527745/melange-microvm-init/var/lib/db/sbom/melange-microvm-init-0.13.3-r0.spdx.json (similarity: 0.99)

[octo-sts]

malcontent detected files with a risk score equal or higher than 'CRITICAL': Click to expand/collapse

/tmp/malcontent1206317828/packages/x86_64/melange-0.13.3-r0.apk/usr/bin/melange [🚨 CRITICAL]

RISK	KEY	DESCRIPTION	EVIDENCE
HIGH	admin/pip_install	Installs software using pip from python	pip installb3312fa7e23ee7e4988e056be3f82d19
CRITICAL	combo/dropper/shell	change dir, fetch file via tor, make it executable, and run it	./b ./configure --prefix ./configure command. ./configure.ac ./dist/ ./m ./package.json ./pipe/docker ./pombump-deps.yaml ./pombump-properties.yaml .onion cd $ cd /home/build chmod curl -L
HIGH	ref/path/hidden	hidden path in a system directory	scallhtml3125Atoilib/bin/.so.