~ / search / GHSA-739f-hw6h-7wq8

GHSA-739f-hw6h-7wq8

PolicyController before 0.2.1 may bypass attestation verification

Source: GitHub Advisory Database (reviewed) High CVE-2022-35930

Packages

EcosystemPackageAffectedFixed in
Go github.com/sigstore/policy-controller < 0.2.1 0.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

PolicyController will report a false positive, resulting in an admission when it should not be admitted when: * There is at least one attestation with a valid signature * There are NO attestations of the type being verified (--type defaults to "custom") Users should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.

References

External links from the advisory. They lead to third-party sites.