Back to Policies

Verify Image Check CVE-2022-42889

CVE-2022-42889 is a critical vulnerability in the Apache Commons Text library which could lead to arbitrary code executions and occurs in versions 1.5 through 1.9. Detecting the affected package may be done in an SBOM by identifying the "commons-text" package with one of the affected versions. This policy checks attested SBOMs in CycloneDX format of an image specified under `imageReferences` and denies it if it contains versions 1.5-1.9 of the commons-text package. Using this for your own purposes will require customizing the `imageReferences`, `subject`, and `issuer` fields based on your image signatures and attestations.

View on GitHub

Policy Definition 

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-image-vulns-cve-2022-42889
  annotations:
    policies.kyverno.io/title: Verify Image Check CVE-2022-42889
    policies.kyverno.io/category: Software Supply Chain Security
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/minversion: 1.8.3
    kyverno.io/kyverno-version: 1.9.0
    kyverno.io/kubernetes-version: "1.24"
    policies.kyverno.io/description: CVE-2022-42889 is a critical vulnerability in the Apache Commons Text library which could lead to arbitrary code executions and occurs in versions 1.5 through 1.9. Detecting the affected package may be done in an SBOM by identifying the "commons-text" package with one of the affected versions. This policy checks attested SBOMs in CycloneDX format of an image specified under `imageReferences` and denies it if it contains versions 1.5-1.9 of the commons-text package. Using this for your own purposes will require customizing the `imageReferences`, `subject`, and `issuer` fields based on your image signatures and attestations.
spec:
  validationFailureAction: Audit
  webhookTimeoutSeconds: 10
  rules:
    - name: cve-2022-42889
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - myreg.org/myrepo/someimage*
          attestations:
            - predicateType: https://cyclonedx.org/schema
              attestors:
                - entries:
                    - keyless:
                        subject: mysubject
                        issuer: myissuer
                        rekor:
                          url: https://rekor.sigstore.dev
              conditions:
                - all:
                    - key: "{{ components[?name=='commons-text'].version || 'none' }}"
                      operator: AllNotIn
                      value:
                        - "1.5"
                        - "1.6"
                        - "1.7"
                        - "1.8"
                        - "1.9"

Related Policies

Verify ImagesMedium

Verify Flux Images

Ensures that container images used to run Flux controllers in the cluster are signed with valid Cosign signatures. Prevents the deployment of untrusted or potentially compromised Flux images. Protects the integrity and security of the Flux deployment process.

GitRepository
Verify ImagesMedium

Require Image Vulnerability Scans

An important part of ensuring software supply chain integrity is performing periodic vulnerability scans on images. Initial scans as part of the build process is necessary, but as new vulnerabilities are discovered the scans must be refreshed. This policy ensures that images, signed with Cosign's keyless ability during a GitHub Actions workflow, have attested vulnerability scans not older than one week. This policy is expected to be customized based upon your signing strategy and applicable to the images you designate.

Pod
Verify ImagesMedium

Verify Image GCP KMS

Using the Cosign project, OCI images may be signed to ensure supply chain security is maintained. Those signatures can be verified before pulling into a cluster. This policy checks the signature of an image repo called ghcr.io/kyverno/test-verify-image to ensure it has been signed by verifying its signature against the provided public key. This policy serves as an illustration for how to configure a similar rule and will require replacing with your image(s) and keys.

Pod