CVE-2021-41087

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Insufficient Verification of Data Authenticity pada in-toto-golang. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.

Rincian

Terbit di NVD

21 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290 patch · advisory pihak ketiga
• https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3 advisory pihak ketiga