{"schema_version":"1.3.1","id":"GO-2022-1180","modified":"2024-06-03T20:51:31Z","published":"2022-12-27T18:24:54Z","aliases":["CVE-2022-47633","GHSA-m3cq-xcx9-3gvm"],"summary":"Verification rule bypass in github.com/kyverno/kyverno","details":"A malicious proxy/registry can bypass verifyImages rules.","affected":[{"package":{"name":"github.com/kyverno/kyverno","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.3"},{"fixed":"1.8.5"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/kyverno/kyverno/pkg/engine","symbols":["imageVerifier.verifyAttestation","imageVerifier.verifyAttestations","imageVerifier.verifyAttestorSet","imageVerifier.verifyAttestors","imageVerifier.verifyImage"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm"},{"type":"FIX","url":"https://github.com/kyverno/kyverno/pull/5713"}],"credits":[{"name":"@slashben"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2022-1180","review_status":"REVIEWED"}}