Homebrew 7.0.0 is out, here’s what changed for security
Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.
Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.
- Eight advisories closed: one High, two Moderate, five Low
- High flaw let unsigned cask removal metadata run sudo commands (fixed in 6.0.12)
- 7.0.0 restricts LaunchServices, Mach services, and Unix sockets to block sandbox escape
- brew vulns scans installed formulae against OSV.dev with severity and fix-available filters
- Linux sandboxing moves from Bubblewrap to Landlock
From the original article
3 min read at helpnetsecurity.com
Homebrew installs command-line software and desktop applications from the terminal on macOS and Linux, and Mac developers use it to set up their machines. On Sunday the project shipped version 7. 0.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.