{"action":"Upgrade in-toto to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"in-toto","cve_ids":["CVE-2023-32076"],"ecosystem":"PyPI","epss":0.00243,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-p86f-xmg6-9q4x","id":"tcs_01M5KGKNEXB4VK5KH7YN9H04EM","modified_at":"2023-11-08T04:12:33.377414Z","published_at":"2023-05-10T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-63","https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x","https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf","https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd","https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-63","url":"https://osv.dev/vulnerability/PYSEC-2023-63"}],"summary":"in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from dir"}