Tóm tắt nhanh
- CVE-2022-35930 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng github.com/sigstore/policy-controller, policy controller (sigstore).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.70%, cao hơn 53.1% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 0.2.1 hoặc mới hơn.
Mô tả
PolicyController will report a false positive, resulting in an admission when it should not be admitted when:
- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")
Users should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.
Mô tả của NVD
PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí