CVE-2025-29778: 
Wolfi vulnerability analysis and mitigation

Kyverno, a policy engine designed for cloud native platform engineering teams, contains a vulnerability (CVE-2025-29778) where it ignores subjectRegExp and IssuerRegExp fields while verifying artifact's signatures in keyless mode. This vulnerability was discovered and disclosed on March 24, 2025, affecting versions prior to 1.14.0-alpha.1. The issue allows attackers to deploy Kubernetes resources with artifacts signed by unexpected certificates (GitHub Advisory).

The vulnerability stems from a logic error in the signature verification process where Kyverno only checks subject and issuer fields when verifying an artifact's signature, while ignoring the subjectRegExp and issuerRegExp fields. This oversight occurs in the matchSignatures function of the cosign package. The vulnerability has been assigned a CVSS v3.1 score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N, indicating network attack vector with high complexity and high privileges required (GitHub Advisory).

The vulnerability enables attackers to bypass part of the verification mechanism, potentially leading to the deployment of unauthorized Kubernetes resources. This could result in a full compromise of the Kubernetes cluster if exploited successfully. The impact is particularly significant in environments where certificate validation is crucial for maintaining security boundaries (GitHub Advisory).

The vulnerability has been patched in version 1.14.0-alpha.1. Users are strongly advised to upgrade to this version or later to address the security issue. The fix involves modifying the condition check in the matchSignatures function to properly validate both subjectRegExp and issuerRegExp fields (GitHub Commit).

The vulnerability was initially discovered during testing of image sign verification with keyless signing, and was discussed in the Kubernetes Slack community. The issue was subsequently verified and fixed by the Kyverno development team, who acknowledged its significance as a security problem that could bypass part of the verification mechanism (GitHub Advisory).