Aiir
Monthly
AIIR (invariant-systems-ai aiir) versions prior to 1.7.0 contain fail-open verification and policy gate flaws that allow unauthenticated remote attackers to bypass signature verification controls. When a downstream consumer relies on an affected gate-such as the require_signing policy gate, the CI verification path, the release-verification gate, or a signature-verification path-an attacker can supply an unsigned, forged-bundle, or non-conforming receipt and the gate will falsely report 'verified' or success. This results in low integrity impact (no confidentiality or availability impact) and affects only released versions below 1.7.0; no public exploit code has been identified at time of analysis, and the vulnerability is fixed in 1.7.0.
AIIR (invariant-systems-ai aiir) versions prior to 1.7.0 contain fail-open verification and policy gate flaws that allow unauthenticated remote attackers to bypass signature verification controls. When a downstream consumer relies on an affected gate-such as the require_signing policy gate, the CI verification path, the release-verification gate, or a signature-verification path-an attacker can supply an unsigned, forged-bundle, or non-conforming receipt and the gate will falsely report 'verified' or success. This results in low integrity impact (no confidentiality or availability impact) and affects only released versions below 1.7.0; no public exploit code has been identified at time of analysis, and the vulnerability is fixed in 1.7.0.