Security vulnerabilities and automated fixes for supply chain attack issues
2 posts found
A `.gitea/workflows/release.yml` file contained two critical security issues: GitHub Actions steps using mutable version tags (like `v4`) instead of immutable commit SHAs, and a dangerous `curl | bash` pattern that pipes untrusted remote scripts directly into a shell. These vulnerabilities could enable attackers to inject malicious code into the CI/CD pipeline through action takeovers or compromised download servers.
A critical vulnerability in a Python build script allowed potential man-in-the-middle attackers to bypass SHA256 checksum verification by serving malicious checksums alongside compromised binaries. This fix implements proper cryptographic signature verification, ensuring that downloaded artifacts are genuinely from trusted sources—not just matching a potentially tampered checksum file.