StackRadar

CVE-2022-29173

High

Advisory

Published 24 May 2022In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.0
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4
of 17,781 indexed, latest versions
Container images
6
deployed by those charts
Fix available
1 of 1
affected package

Improper Validation of Integrity Check Value in go-tuf

Carried by container images the latest versions of 4 of 17,781 indexed charts deploy, on 6 images.

Affected packageAffected versionsFixed inImages
github.com/theupdateframework/go-tufgolangv0.0.0-20210630170422-22a94818d17b, v0.0.0-20211203210025-7ded50136bf9, v0.0.0-20220211205608-f0c3294f63b90.3.06
OSV records
GHSA-66x3-6cw3-v5gj
Also known as
GO-2022-0444

Charts affected

4 by stars
ChartLatestAffected imagesRadar Score
cosignedsigstoreVerified publisher0.1.232 of 2See more

cosigned sigstore 0.1.23

2 of the 2 container images this version deploys carry CVE-2022-29173.

Container imageDigestPackageFixed in
gcr.io/projectsigstore/cosigneddigest-pinned784518ff3ee7
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0
gcr.io/projectsigstore/policy-webhookdigest-pinned82940e8c3e0d
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0

Open the chart page →

5,118
kyvernodevopstalesVerified publisher2.5.12 of 2See more

kyverno devopstales 2.5.1

2 of the 2 container images this version deploys carry CVE-2022-29173.

Container imageDigestPackageFixed in
ghcr.io/kyverno/kyverno:v1.7.19c73f1841ebc
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0
ghcr.io/kyverno/kyvernopre:v1.7.1185d2eebc60c
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0

Open the chart page →

4,722
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2022-29173.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/theupdateframework/go-tuf@v0.0.0-20211203210025-7ded50136bf9
0.3.0

Open the chart page →

8,599
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2022-29173.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/theupdateframework/go-tuf@v0.0.0-20210630170422-22a94818d17b
0.3.0

Open the chart page →

29,227

Container images carrying it

6 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
gcr.io/projectsigstore/cosigned784518ff3ee7
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0
1
gcr.io/projectsigstore/policy-webhook82940e8c3e0d
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0
1
ghcr.io/kyverno/kyverno:v1.7.19c73f1841ebc
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0
1
ghcr.io/kyverno/kyvernopre:v1.7.1185d2eebc60c
github.com/theupdateframework/go-tuf@v0.0.0-20220211205608-f0c3294f63b9
0.3.0
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/theupdateframework/go-tuf@v0.0.0-20211203210025-7ded50136bf9
0.3.0
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/theupdateframework/go-tuf@v0.0.0-20210630170422-22a94818d17b
0.3.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.