Crossplane Runtime
Monthly
A time-of-check/time-of-use (TOCTOU) flaw in Crossplane's crossplane-runtime package manager (pkg/xpkg/client.go) lets a malicious OCI registry defeat cosign package signature verification, causing an unsigned or tampered package to be installed in place of the verified one. Exploitation requires an unusual combination of non-default operational choices: signature verification enabled through the ImageConfig mechanism, packages installed by mutable tag reference (such as a semantic version) instead of an immutable digest, and installation from a registry the operator does not control, where the attacker can serve a signed image for the cosign verifier and a different unsigned image moments later for the fetch. Impact is limited to integrity - an unverified package is pulled and installed - with no direct confidentiality or availability effect, and no public exploit code has been identified at time of analysis. Fixes are available in crossplane-runtime v2.2.3, v2.3.3, and v2.4.0-rc.1.
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A time-of-check/time-of-use (TOCTOU) flaw in Crossplane's crossplane-runtime package manager (pkg/xpkg/client.go) lets a malicious OCI registry defeat cosign package signature verification, causing an unsigned or tampered package to be installed in place of the verified one. Exploitation requires an unusual combination of non-default operational choices: signature verification enabled through the ImageConfig mechanism, packages installed by mutable tag reference (such as a semantic version) instead of an immutable digest, and installation from a registry the operator does not control, where the attacker can serve a signed image for the cosign verifier and a different unsigned image moments later for the fetch. Impact is limited to integrity - an unverified package is pulled and installed - with no direct confidentiality or availability effect, and no public exploit code has been identified at time of analysis. Fixes are available in crossplane-runtime v2.2.3, v2.3.3, and v2.4.0-rc.1.
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.