Threats tagged 'ghsa-2vqq-m4qm-q6m7'

Kyverno versions 1.18.0 up to but not including 1.19.2 contain a vulnerability in the verifyImages function where signature verification can be bypassed. This occurs because cached verification results are keyed by image reference strings (e.g., tags) rather than the verified image digest. An attacker able to submit workloads and manipulate registry tags can exploit this to bypass signature and attestation checks, causing Kyverno to admit workloads with unverified images.