PyPI/in-toto CVE-2023-32076: unknown, EPSS 0.24%
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from dir
Action: Upgrade in-toto to 2.0.0 or later.
pip install in-toto==2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: PYSEC-2023-63
- https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x
- https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf
- https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd
- https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
CVE-2023-32076 · published · modified · JSON