Skip to content
OpenAdvisories

Package · Go

github.com/crossplane/crossplane/v2

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.0
    GHSA-wfqx-gjrf-g28r

    Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

    ## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is inst…

    github.com/crossplane/crossplane github.com/crossplane/crossplane/v2 Go