PT-2023-23587 · In-Toto+1 · In-Toto+1

Adityasaky · Published 2023-05-10 · Updated 2023-05-18 · CVE-2023-32076

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions in-toto versions 1.4.0 and prior

Description The in-toto configuration is read from various directories, allowing users to configure the framework's behavior. Among the files read is .in totorc, a hidden file in the directory where in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by passing in an .in totorc file with necessary exclude patterns and settings. RC files are widely used in other systems, and security issues have been discovered in their implementations. Maintainers found that in totorc is not the preferred way to configure in-toto, and as the options supported in in totorc can be set elsewhere using API parameters or CLI arguments, they decided to drop support for in totorc.

Recommendations For versions 1.4.0 and prior, consider updating to a version where support for in totorc has been dropped, as the maintainers have removed the user settings module altogether. As a temporary workaround, consider disabling the use of .in totorc files until a patch is available. Sandbox functionary code as a security measure to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-15

CWE-610

Related Identifiers

CVE-2023-32076

GHSA-P86F-XMG6-9Q4X

GHSA-WC64-C5RV-32PF

PYSEC-2023-63

Affected Products

Debian

In-Toto

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32076.json · Exploit
• https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd · Patch
• https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf · Vendor Advisory
• https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32076 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32076 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32076 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-32076 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc64-c5rv-32pf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-32076 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32076 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32076 · Vendor Advisory
• https://github.com/in-toto/in-toto · Note
• https://github.com/in-toto/in-toto/releases/tag/v2.0.0 · Note