Refine your search
2 vulnerabilities found for isar by ilbers
CVE-2026-55222 (GCVE-0-2026-55222)
Vulnerability from cvelistv5
Published
2026-10-23 14:31
Modified
2026-10-23 20:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1290 - Incorrect Decoding of Security Identifiers
Summary
Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. The issue is has no impact on those images that use an immutable rootfs, or if apt is never invoked. Changing only the keys does not trigger an exploit, it's just one step in a chain. An attacker would also have to manipulate a remote repo or intercept non-secure communication with it. This issue has been patched via commit 29e84ed.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T20:43:46.972782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:57:39.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "isar",
"vendor": "ilbers",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.11, \u003c= 1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user\u0027s id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, silently breaking the apt repo integrity protection. The issue is has no impact on those images that use an immutable rootfs, or if apt is never invoked. Changing only the keys does not trigger an exploit, it\u0027s just one step in a chain. An attacker would also have to manipulate a remote repo or intercept non-secure communication with it. This issue has been patched via commit 29e84ed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1290",
"description": "CWE-1290: Incorrect Decoding of Security Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T14:31:41.863Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ilbers/isar/security/advisories/GHSA-rq66-pfw5-whqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ilbers/isar/security/advisories/GHSA-rq66-pfw5-whqq"
},
{
"name": "https://github.com/ilbers/isar/commit/29e84ed301c8d25c570300cf82b563b7961392b0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ilbers/isar/commit/29e84ed301c8d25c570300cf82b563b7961392b0"
}
],
"source": {
"advisory": "GHSA-rq66-pfw5-whqq",
"discovery": "UNKNOWN"
},
"title": "Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55222",
"datePublished": "2026-10-23T14:31:41.863Z",
"dateReserved": "2026-06-16T16:16:32.628Z",
"dateUpdated": "2026-10-23T20:57:39.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65100 (GCVE-0-2025-65100)
Vulnerability from cvelistv5
Published
2025-11-19 18:52
Modified
2025-11-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-693 - Protection Mechanism Failure
Summary
Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T20:27:01.525384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T20:28:15.251Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "isar",
"vendor": "ilbers",
"versions": [
{
"status": "affected",
"version": "\u003c 738bcbb716c7eb7b34cbb2293cae4f264b3925fe"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T18:52:42.496Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ilbers/isar/security/advisories/GHSA-3r9w-6cp6-7hm4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ilbers/isar/security/advisories/GHSA-3r9w-6cp6-7hm4"
},
{
"name": "https://github.com/ilbers/isar/commit/3383fd808a4ced93e41e012660dfe364a3384434",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ilbers/isar/commit/3383fd808a4ced93e41e012660dfe364a3384434"
},
{
"name": "https://github.com/ilbers/isar/commit/738bcbb716c7eb7b34cbb2293cae4f264b3925fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ilbers/isar/commit/738bcbb716c7eb7b34cbb2293cae4f264b3925fe"
}
],
"source": {
"advisory": "GHSA-3r9w-6cp6-7hm4",
"discovery": "UNKNOWN"
},
"title": "Security Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is Set"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-65100",
"datePublished": "2025-11-19T18:52:42.496Z",
"dateReserved": "2025-11-17T20:55:34.692Z",
"dateUpdated": "2025-11-19T20:28:15.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}