CVE-2022-35930: PolicyController before 0.2.1 may bypass attestation verification
7.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.22948%
CWE
Published
8/10/2022
Updated
1/30/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/sigstore/policy-controller | go | < 0.2.1 | 0.2.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from how attestation types were handled in ValidatePolicyAttestationsForAuthority. The original code:
- Skipped type checking when wantedAttestation.Type was empty
- When type was specified, it would still add all verifiedAttestations to the result set after policy evaluation
- Had no check for empty filtered attestations of the required type
The patch introduces:
- A 'checkedAttestations' list that only includes type-matching attestations
- An explicit error when no matching attestations are found
- Uses filtered list instead of all verifiedAttestations for the final result
This matches the vulnerability description of false positives occurring when valid signatures exist but required type attestations are missing.