Crossplane TOCTOU Vulnerability Bypasses Signature Check via Image Tag (GHSA-mf7q-r4rv-jy94)

Vulnerability Overview A TOCTOU (Time-of-Check to Time-of-Use) vulnerability exists in Crossplane between cosign verification and image retrieval. In , installing packages via tags allows bypassing signature checks. Affected Versions Affected Versions: - - Fixed Versions: - - Remediation 1. Use Image Digests Instead of Tags When Installing Packages: - Installing packages using image digests instead of tags mitigates this issue. 2. Code Updates: - The package manager has been updated to resolve tag references only once and use the resulting digest for both signature verification and image retrieval. This ensures that the content pulled by Crossplane is identical to the content verified by signatures. - The fix has been applied to the branch of Crossplane and backported to the and release branches; it will be released in and . Additional Information Severity: High (8.2 / 10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: High - Availability: None Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None EPSS Score: - Weaknesses: - CVE-345 - CVE-367 CVE ID: No known CVE GHSA ID: GHSA-mf7q-r4rv-jy94 Source Code: crossplane/crossplane-runtime Credit: - Reporter: tonghuaroot, bugbunny-research References GHSA-mf7q-r4rv-jy94 Update History August 16, 2024: adamwq released an update for crossplane/crossplane-runtime. August 28, 2024: Published to the GitHub Security Database. August 28, 2024: Reviewed. August 28, 2024: Last updated.

Goal Reached Thanks to every supporter — we hit 100%!

Crossplane TOCTOU Vulnerability Bypasses Signature Check via Image Tag (GHSA-mf7q-r4rv-jy94)

More from this source