Crossplane
Monthly
A time-of-check/time-of-use (TOCTOU) flaw in Crossplane's crossplane-runtime package manager (pkg/xpkg/client.go) lets a malicious OCI registry defeat cosign package signature verification, causing an unsigned or tampered package to be installed in place of the verified one. Exploitation requires an unusual combination of non-default operational choices: signature verification enabled through the ImageConfig mechanism, packages installed by mutable tag reference (such as a semantic version) instead of an immutable digest, and installation from a registry the operator does not control, where the attacker can serve a signed image for the cosign verifier and a different unsigned image moments later for the fetch. Impact is limited to integrity - an unverified package is pulled and installed - with no direct confidentiality or availability effect, and no public exploit code has been identified at time of analysis. Fixes are available in crossplane-runtime v2.2.3, v2.3.3, and v2.4.0-rc.1.
Crossplane is a framework for building cloud native control planes without needing to write code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Crossplane is a framework for building cloud native control planes without needing to write code. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A time-of-check/time-of-use (TOCTOU) flaw in Crossplane's crossplane-runtime package manager (pkg/xpkg/client.go) lets a malicious OCI registry defeat cosign package signature verification, causing an unsigned or tampered package to be installed in place of the verified one. Exploitation requires an unusual combination of non-default operational choices: signature verification enabled through the ImageConfig mechanism, packages installed by mutable tag reference (such as a semantic version) instead of an immutable digest, and installation from a registry the operator does not control, where the attacker can serve a signed image for the cosign verifier and a different unsigned image moments later for the fetch. Impact is limited to integrity - an unverified package is pulled and installed - with no direct confidentiality or availability effect, and no public exploit code has been identified at time of analysis. Fixes are available in crossplane-runtime v2.2.3, v2.3.3, and v2.4.0-rc.1.
Crossplane is a framework for building cloud native control planes without needing to write code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Crossplane is a framework for building cloud native control planes without needing to write code. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.