{"id":"CVE-2022-35930","aliases":["GHSA-739f-hw6h-7wq8","GO-2022-0759"],"title":"PolicyController before 0.2.1 may bypass attestation verification","summary":"PolicyController before 0.2.1 may bypass attestation verification","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","vendor":"sigstore","product":"github.com/sigstore/policy-controller","ecosystem":"go","affected":["github.com/sigstore/policy-controller < 0.2.1"],"patched":["github.com/sigstore/policy-controller 0.2.1"],"published":"2022-08-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:42.503477951Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-739f-hw6h-7wq8","references":[{"url":"https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35930"},{"url":"https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8"},{"url":"https://github.com/sigstore/policy-controller"},{"url":"https://github.com/sigstore/policy-controller/releases/tag/v0.2.1"}],"tags":["osv","go"],"epss":0.00644,"epssPercentile":0.4912,"ingestedAt":"2026-09-12T03:13:01.762Z","slug":"CVE-2022-35930","body":"## Overview\n\nPolicyController will report a false positive, resulting in an admission when it should not be admitted when:\n * There is at least one attestation with a valid signature\n * There are NO attestations of the type being verified (--type defaults to \"custom\")\n\nUsers should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.\n\n## Affected packages\n\n- `github.com/sigstore/policy-controller < 0.2.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/sigstore/policy-controller 0.2.1`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}