CVE-2025-29778
CVE-2025-29778
Título es
CVE-2025-29778
Lun, 24/03/2025 – 17:15
Tipo
CWE-285
Gravedad 2.0 Txt
Pendiente de análisis
Título en
CVE-2025-29778
Descripción en
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.
24/03/2025
24/03/2025
Vector CVSS:3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Gravedad 3.1 (CVSS 3.1 Base Score)
5.80
Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
MEDIUM
Referencias
Enviar en el boletín
Off
