Users of Kyverno on versions 1.8.3 or 1.8.4 who use verifyImages
rules to verify container image signatures, and do not prevent use of unknown registries.
This issue has been fixed in version 1.8.5
Configure a Kyverno policy to restrict registries to a set of secure trusted image registries (sample).
{ "nvd_published_at": "2022-12-23T23:15:00Z", "cwe_ids": [ "CWE-287" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2022-12-21T17:24:10Z" }