Описание
A flaw was found in operator-sdk-builder. The containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries that are not explicitly listed. This default setting causes signature verification to be entirely skipped for images pulled from these unlisted registries, which could allow for the use of untrusted or malicious container images.
Отчет
This Moderate flaw in operator-sdk-builder within Konflux allows skipping image signature verification for non-Red Hat registries due to an insecure default policy. This could enable the use of untrusted container images if not explicitly configured, increasing the risk of supply chain attacks.
Меры по смягчению последствий
To prevent the use of untrusted container images, configure the containers-policy.json to reject unsigned images by default. Set the default policy to {"type": "reject"} and add explicit signedBy or sigstoreSigned entries for all trusted registries. This policy should be mounted when invoking opm or operator-sdk against third-party registries. A restart of the operator-sdk-builder or related services may be required for the new policy to be enforced.
Дополнительная информация
Статус:
4.2 Medium
CVSS3
4.2 Medium
CVSS3