GHSA-vrxp-mg9f-hwf3

Source

https://github.com/advisories/GHSA-vrxp-mg9f-hwf3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-vrxp-mg9f-hwf3/GHSA-vrxp-mg9f-hwf3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vrxp-mg9f-hwf3

Aliases

Related

CVE-2021-41087

Published

2021-09-22T20:37:09Z

Modified

2024-08-21T16:28:49.688565Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Improperly Implemented path matching for in-toto-golang

Details

Impact

Authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo).

Patches

The problem has been fixed in version 0.3.0.

Workarounds

Exploiting this vulnerability is dependent on the specific policy applied.

For more information

If you have any questions or comments about this advisory: * Open an issue in in-toto-golang * Email us at in-toto-public * If this is a sensitive security-relevant disclosure, please send a PGP encrypted email to santiagotorres@purdue.edu or jcappos@nyu.edu

Database specific

{
    "nvd_published_at": "2021-09-21T21:15:00Z",
    "github_reviewed_at": "2021-09-21T21:51:18Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22",
        "CWE-345"
    ]
}

References

Affected packages

Go / github.com/in-toto/in-toto-golang

Package

Name: github.com/in-toto/in-toto-golang; View open source insights on deps.dev
Purl: pkg:golang/github.com/in-toto/in-toto-golang

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.0

Database specific

{
    "last_known_affected_version_range": "<= 0.2.0"
}