{"id":"CVE-2022-35930","aliases":["EUVD-2022-6496","GHSA-739f-hw6h-7wq8","GO-2022-0759"],"status":"published","title":"Ability to bypass attestation verification in sigstore PolicyController","description":"PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00696,"percentile":0.53314,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2022-08-04T21:15:15Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Go","package":"github.com/sigstore/policy-controller","fixed_in":["0.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/sigstore/policy-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sigstore/policy-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sigstore/policy-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]}],"products":[{"vendor":"sigstore","product":"policy-controller"},{"vendor":"sigstore","product":"policy_controller"}],"references":[{"url":"https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/sigstore/policy-controller/releases/tag/v0.2.1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35930","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-739f-hw6h-7wq8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35930.json","tags":["advisory"]},{"url":"https://github.com/sigstore/policy-controller","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-35930","title":"Ability to bypass attestation verification in sigstore PolicyController","description":"PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.","status":"published","published":"2022-08-04T21:15:15Z","modified":"2025-04-23T17:53:16.444Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-6496","description":"PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.","status":"published","published":"2022-08-04T21:15:15Z","modified":"2025-04-23T17:53:16Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"ghsa":[{"id":"GHSA-739f-hw6h-7wq8","title":"PolicyController before 0.2.1 may bypass attestation verification","description":"PolicyController will report a false positive, resulting in an admission when it should not be admitted when:\n * There is at least one attestation with a valid signature\n * There are NO attestations of the type being verified (--type defaults to \"custom\")\n\nUsers should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.","status":"published","published":"2022-08-10T18:38:16Z","modified":"2023-01-30T05:01:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:27.500048Z"}],"nvd":[{"id":"CVE-2022-35930","description":"PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.","status":"published","published":"2022-08-04T22:15:08.07Z","modified":"2026-06-17T04:52:32.783Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-35930","title":"Ability to bypass attestation verification in sigstore PolicyController","description":"PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.","status":"published","published":"2022-08-04T21:15:15Z","modified":"2026-10-28T02:31:05.514221306Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-739f-hw6h-7wq8","title":"PolicyController before 0.2.1 may bypass attestation verification","description":"PolicyController will report a false positive, resulting in an admission when it should not be admitted when:\n * There is at least one attestation with a valid signature\n * There are NO attestations of the type being verified (--type defaults to \"custom\")\n\nUsers should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.","status":"published","published":"2022-08-10T18:38:16Z","modified":"2026-09-10T03:49:42.503477951Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"GO-2022-0759","title":"PolicyController before 0.2.1 may bypass attestation verification in github.com/sigstore/policy-controller","description":"PolicyController before 0.2.1 may bypass attestation verification in github.com/sigstore/policy-controller","status":"published","published":"2024-08-21T15:21:45Z","modified":"2026-02-04T03:31:54.827703Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}