Crossplane
v2.2.3Orchestration & ManagementCrossplane v2.2.3 patches a TOCTOU vulnerability in package signature verification (GHSA-wfqx-gjrf-g28r) and bumps Go toolchain and dependencies for security fixes.
securityPatch the TOCTOU signature verification flaw now if you use tag-based installs
If your team installs Crossplane packages by tag (not digest) from registries you don't fully control, this TOCTOU flaw (GHSA-wfqx-gjrf-g28r) let a malicious registry pass signature verification with one image and then serve a different, unsigned image at install time. Upgrade to v2.2.3 immediately. As a defense-in-depth measure, consider switching package installs to digest references — that would have avoided this issue entirely regardless of the Crossplane version.
securityGo 1.25.11 and golang.org/x/net v0.55.0 pick up upstream CVE fixes
The Go toolchain bump and net package update carry security fixes from upstream. There is no separate action beyond upgrading to v2.2.3, but if you scan container images for CVEs, expect findings against older Crossplane images to include these — use v2.2.3 as your baseline for compliance scans.
主な変更 (4)
- Fixed TOCTOU flaw (GHSA-wfqx-gjrf-g28r): tag references are now resolved to a digest once, used for both verification and pull
- Go toolchain bumped to 1.25.11 for upstream security fixes
- golang.org/x/net updated to v0.55.0
- crossplane-runtime updated to v2.2.3