CVE-2023-32076
2 advisories.
PyPI/in-toto CVE-2023-32076: medium 5.5, EPSS 0.24%
in-toto vulnerable to Configuration Read From Local Directory
Action: Upgrade in-toto to 2.0.0 or later.
pip install in-toto==2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: GHSA-wc64-c5rv-32pf
- https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x
- https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf
- https://nvd.nist.gov/vuln/detail/CVE-2023-32076
- https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd
- https://github.com/in-toto/in-toto
- https://github.com/in-toto/in-toto/releases/tag/v2.0.0
- https://github.com/pypa/advisory-database/tree/main/vulns/in-toto/PYSEC-2023-63.yaml
- https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
CVE-2023-32076 · published · modified · JSON
PyPI/in-toto CVE-2023-32076: unknown, EPSS 0.24%
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from dir
Action: Upgrade in-toto to 2.0.0 or later.
pip install in-toto==2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: PYSEC-2023-63
- https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x
- https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf
- https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd
- https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
CVE-2023-32076 · published · modified · JSON