tocsin

Go/github.com/crossplane/crossplane/v2: critical 9

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Action: Upgrade github.com/crossplane/crossplane/v2 to 2.2.3 or later.

go get github.com/crossplane/crossplane/v2@v2.3.3
go get github.com/crossplane/crossplane/v2@v2.2.3

Affected

introducedfixedlast affected
2.3.0-rc.02.3.3-
02.2.3-

Fixed versions

2.3.32.2.3

Sources

published · modified · JSON