So Alpine Linux has a pretty serious set of vulnerabilities because

- It doesn鈥檛 download packages over TLS, making them prone to MitM. Which on its own isn鈥檛 terrible but it also...

- Doesn鈥檛 check hashes before extracting to root (!)

- And uses custom gzip code which is vulnerable to arbitrary code execution (!!)


@cypnk @angristan Actually, the first isn't crucial if the second is (and it MUST br) implemented correctly.

Sign in to participate in the conversation

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!