id: GO-2022-1180
modules:
    - module: github.com/kyverno/kyverno
      versions:
        - introduced: 1.8.3
          fixed: 1.8.5
      vulnerable_at: 1.8.5-0.20221217180442-ef63302dc479
      packages:
        - package: github.com/kyverno/kyverno/pkg/engine
          symbols:
            - imageVerifier.verifyAttestation
            - imageVerifier.verifyAttestations
            - imageVerifier.verifyAttestors
            - imageVerifier.verifyAttestorSet
            - imageVerifier.verifyImage
          skip_fix: 'TODO: revisit this reason (undefined: gojmespath.NotFoundError)'
summary: Verification rule bypass in github.com/kyverno/kyverno
description: A malicious proxy/registry can bypass verifyImages rules.
cves:
    - CVE-2022-47633
ghsas:
    - GHSA-m3cq-xcx9-3gvm
credits:
    - '@slashben'
references:
    - advisory: https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm
    - fix: https://github.com/kyverno/kyverno/pull/5713
    - web: https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries