CVE-2022-35930

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
sigstore	policy-controller	< 0.2.1

References

https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8Patch, Third Party Advisory
https://github.com/sigstore/policy-controller/releases/tag/v0.2.1Third Party Advisory
https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8Third Party Advisory
https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8Patch, Third Party Advisory
https://github.com/sigstore/policy-controller/releases/tag/v0.2.1Third Party Advisory
https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8Third Party Advisory

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359312.7Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, CVE-2022-359325.3Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected convers CVE-2022-359336.1This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could s CVE-2022-359347.5TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of s CVE-2022-359357.5TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHE CVE-2022-359365.3Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes CVE-2022-359379.1TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and o CVE-2022-359389.1TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and o CVE-2022-359399.8TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of CVE-2022-35945.3A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback CVE-2022-359407.5TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used t CVE-2022-359417.5TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argument `ksize` that must be positive but is