Skip to content
OpenAdvisories

Package · Go

github.com/crossplane/crossplane

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    GHSA-wfqx-gjrf-g28r

    Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

    ## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is inst…

    github.com/crossplane/crossplane github.com/crossplane/crossplane/v2 Go
  • Critical 9.8
    GHSA-7h65-4p22-39j6

    github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

    A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the `net/netip` package, but the version of gola…

    github.com/crossplane/crossplane Go