PT-2021-23079 · Unknown · In-Toto-Golang

Pxp928 · Published 2021-09-21 · Updated 2024-08-21 · CVE-2021-41087

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions in-toto-golang versions prior to 0.3.0

Description The issue allows authenticated attackers posing as functionaries to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys may issue an attestation that contains a disallowed artifact by including path traversal semantics, such as dir/../foo. Exploiting this issue is dependent on the specific policy applied.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 to resolve the issue. As a temporary workaround, consider restricting access to trusted private keys and reviewing the specific policy applied to minimize the risk of exploitation.

Fix

Path traversal

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-22

CWE-345

Related Identifiers

CVE-2021-41087

GHSA-VRXP-MG9F-HWF3

GO-2022-0936

Affected Products

In-Toto-Golang

References · 9

• https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290 · Patch
• https://osv.dev/vulnerability/GO-2022-0936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrxp-mg9f-hwf3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41087 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41087 · Vendor Advisory
• https://github.com/in-toto/in-toto-golang · Note
• https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3 · Note
• https://t.me/cibsecurity/29205 · Telegram Post
• https://t.me/cvenotify/21931 · Telegram Post