PT-2022-23036 · Unknown · Policycontroller

Mattmoor · Published 2022-08-04 · Updated 2024-08-21 · CVE-2022-35930

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PolicyController versions prior to 0.2.1

Description The issue arises when there is at least one attestation with a valid signature and no attestations of the type being verified, with --type defaulting to "custom". This results in a false positive, leading to an admission when it should not be admitted. An example image to test this is ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2.

Recommendations To resolve this issue, users should upgrade to version 0.2.1 or greater. There are no workarounds for users unable to upgrade.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2022-35930

GHSA-739F-HW6H-7WQ8

GO-2022-0759

Affected Products

Policycontroller

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35930.json · Exploit
• https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-35930 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35930 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0759 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-739f-hw6h-7wq8 · Vendor Advisory
• https://github.com/sigstore/policy-controller/releases/tag/v0.2.1 · Note
• https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8 · Note
• https://github.com/sigstore/policy-controller · Note
• https://t.me/cvenotify/34602 · Telegram Post
• https://t.me/cvenotify/34280 · Telegram Post