CVE-2022-35930

    Dashboard / Vulnerabilities / CVE-2022-35930

    CVE-2022-35930

    Published: 4 Aug 2022Last Modified: 12 Aug 2026

    Summary: Ability to bypass attestation verification in sigstore PolicyController

    Details: PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.

    References: https://github.com/sigstore/policy-controller/releases/tag/v0.2.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35930.json, https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8, https://nvd.nist.gov/vuln/detail/CVE-2022-35930, https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6e9b0b89aaf11af349cf69e287fea64c2c20691f

    Affected versions

    v0.2.0-rc.2
    v0.2.0
    v0.2.0-rc.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35930 | CVE-DB