{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.4.0"}],"component":"in-toto","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jjgp-whrp-gq8m","id":"tcs_01M5KFP3DBYHAY9Z9GJRAX8MDR","modified_at":"2024-11-30T05:49:28.120573Z","published_at":"2023-05-11T20:48:15Z","references":["https://osv.dev/vulnerability/GHSA-jjgp-whrp-gq8m","https://github.com/in-toto/in-toto/security/advisories/GHSA-jjgp-whrp-gq8m","https://github.com/in-toto/in-toto/issues/569","https://github.com/secure-systems-lab/securesystemslib/issues/190","https://github.com/in-toto/in-toto"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jjgp-whrp-gq8m","url":"https://osv.dev/vulnerability/GHSA-jjgp-whrp-gq8m"}],"summary":"in-toto: PGP trust model not (fully) considered"}