Ability to bypass attestation verification in sigstore PolicyController
CVE-2022-35930

7.1HIGH

Key Information:

Vendor

Sigstore

Status
Policy-controller
Vendor
CVE Published:
4 August 2022

What is CVE-2022-35930?

PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.

Affected Version(s)

policy-controller < 0.2.1

References

https://github.com/sigstore/policy-controller/security/ad...
x_refsource_CONFIRM
https://github.com/sigstore/policy-controller/commit/e852...
x_refsource_MISC
https://github.com/sigstore/policy-controller/releases/ta...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.