Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane

Description

References

• crossplane/crossplane security advisory · ADVISORY

More vulnerabilities in github.com/crossplane/crossplane

• GHSA-wfqx-gjrf-g28rCRITICAL 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
• GO-2024-3219github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
• GHSA-7h65-4p22-39j6CRITICAL 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
• CVE-2023-38495CRITICAL 9.8Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1…
• CVE-2023-37900LOW 2.7Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1…