GHSA-739f-hw6h-7wq8HighCVSS 7.1

PolicyController before 0.2.1 may bypass attestation verification

Published
August 10, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-35930 →

📋 Description

PolicyController will report a false positive, resulting in an admission when it should not be admitted when:

  • There is at least one attestation with a valid signature
  • There are NO attestations of the type being verified (--type defaults to "custom")

Users should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.

🎯 Affected products1

  • go/github.com/sigstore/policy-controller:< 0.2.1

🔗 References (5)