pysec - pysec-2023-63

pysec-2023-63

Vulnerability from pysec

Published

2023-05-10 18:15

Modified

2023-06-05 01:12

Details

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is .in_totorc which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an .in_totorc file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that in_totorc is not their preferred way to configure in-toto. As none of the options supported in in_totorc is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for in_totorc. in-toto's user_settings module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.

Impacted products

Name	purl
in-toto	pkg:pypi/in-toto

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "in-toto",
        "purl": "pkg:pypi/in-toto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3a21d84f40811b7d191fa7bd17265c1f99599afd"
            }
          ],
          "repo": "https://github.com/in-toto/in-toto",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.1",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.3.dev2",
        "0.2.3.dev3",
        "0.2.3.dev4",
        "0.2.3.dev5",
        "0.2.dev3",
        "0.3.0",
        "0.4.0",
        "0.4.1",
        "0.4.2",
        "0.5.0",
        "1.0.0",
        "1.0.1",
        "1.1.0",
        "1.1.1",
        "1.2.0",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32076",
    "GHSA-p86f-xmg6-9q4x",
    "GHSA-wc64-c5rv-32pf"
  ],
  "details": "in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto\u0027s `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.",
  "id": "PYSEC-2023-63",
  "modified": "2023-06-05T01:12:53.259453Z",
  "published": "2023-05-10T18:15:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf"
    },
    {
      "type": "FIX",
      "url": "https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd"
    },
    {
      "type": "WEB",
      "url": "https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html"
    }
  ]
}

CVE-2023-32076 (GCVE-0-2023-32076)

Vulnerability from cvelistv5

Published

2023-05-10 17:58

Modified

2025-01-27 18:31

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-15 - External Control of System or Configuration Setting

Summary

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.

References

►

URL

Tags

	https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf	x_refsource_CONFIRM
	https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x	x_refsource_MISC
	https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd	x_refsource_MISC
	https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	in-toto	in-toto	Version: <= 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:03:29.180Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf"
          },
          {
            "name": "https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x"
          },
          {
            "name": "https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd"
          },
          {
            "name": "https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-32076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-27T18:31:43.127939Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-27T18:31:51.016Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "in-toto",
          "vendor": "in-toto",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto\u0027s `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15: External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-10T17:58:09.921Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf"
        },
        {
          "name": "https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x"
        },
        {
          "name": "https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd"
        },
        {
          "name": "https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html"
        }
      ],
      "source": {
        "advisory": "GHSA-wc64-c5rv-32pf",
        "discovery": "UNKNOWN"
      },
      "title": "in-toto vulnerable to Configuration Read From Local Directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-32076",
    "datePublished": "2023-05-10T17:58:09.921Z",
    "dateReserved": "2023-05-01T16:47:35.315Z",
    "dateUpdated": "2025-01-27T18:31:51.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-wc64-c5rv-32pf

Vulnerability from github

Published

2023-05-11 20:47

Modified

2023-05-11 20:47

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

in-toto vulnerable to Configuration Read From Local Directory

Details

Impact

The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification [1]. Among the files read is .in_totorc which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an .in_totorc file that includes the necessary exclude patterns and settings.

RC files are widely used in other systems [2] and security issues have been discovered in their implementations as well [3]. We found in our conversations with in-toto adopters that in_totorc is not their preferred way to configure in-toto. As none of the options supported in in_totorc is unique, and can be set elsewhere using API parameters or CLI arguments, we decided to drop support for in_totorc.

Other Recommendations

Sandbox functionary code as recommended in https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x.

References

[1] https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html [2] https://spec.editorconfig.org/ [3] https://github.blog/2022-04-12-git-security-vulnerability-announced/

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.4.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "in-toto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15",
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-11T20:47:56Z",
    "nvd_published_at": "2023-05-10T18:15:10Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification [1]. Among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings.\n\nRC files are widely used in other systems [2] and security issues have been discovered in their implementations as well [3]. We found in our conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, we decided to drop support for `in_totorc`.\n\n### Other Recommendations\n\nSandbox functionary code as recommended in https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x.\n\n### References\n\n[1] https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html\n[2] https://spec.editorconfig.org/\n[3] https://github.blog/2022-04-12-git-security-vulnerability-announced/\n",
  "id": "GHSA-wc64-c5rv-32pf",
  "modified": "2023-05-11T20:47:56Z",
  "published": "2023-05-11T20:47:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32076"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in-toto/in-toto/commit/3a21d84f40811b7d191fa7bd17265c1f99599afd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/in-toto/in-toto"
    },
    {
      "type": "WEB",
      "url": "https://github.com/in-toto/in-toto/releases/tag/v2.0.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/in-toto/PYSEC-2023-63.yaml"
    },
    {
      "type": "WEB",
      "url": "https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "in-toto vulnerable to Configuration Read From Local Directory"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2023-63

Vulnerability from pysec

CVE-2023-32076 (GCVE-0-2023-32076)

Vulnerability from cvelistv5

ghsa-wc64-c5rv-32pf

Vulnerability from github

Impact

Other Recommendations

References

Tags

Sightings

Nomenclature