Threats tagged 'ghsa-p8fx-8mgf-mvw3'

Kyverno versions before 1.19.2 contain an authentication bypass vulnerability in the matchCertificateData function. This flaw allows attackers with a leaf certificate from a configured private trust root to bypass verifyImages subject and subjectRegExp checks if the signing certificate lacks a Subject Alternative Name (SAN). By omitting the SAN and setting the expected Fulcio issuer OID, attackers can sign malicious images that are admitted despite signer pinning.