GitHub Advisoryadvisory · Go

GHSA-m3cq-xcx9-3gvm kyverno verifyImages rule bypass possible with malicious proxy/registry

HIGH Published 2022-12-21 Modified 2025-04-15 Official page ↗
Aliases
CVE-2022-47633
Ecosystem
Go
Packages
github.com/kyverno/kyverno
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2022-12-21

Affected packages

• Go github.com/kyverno/kyverno: >= 1.8.3, < 1.8.5 → fixed in 1.8.5

Description

Impact Users of Kyverno on versions 1.8.3 or 1.8.4 who use `verifyImages` rules to verify container image signatures, and do not prevent use of unknown registries. Patches This issue has been fixed in version 1.8.5 Workarounds Configure a Kyverno policy to restrict registries to a set of secure trusted image registries (sample). References

Related

Alias · CVE (1)

  • CVE-2022-47633 An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References