Skip to content
OpenAdvisories

Package · Go

github.com/in-toto/in-toto-golang

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.1
    GHSA-pmwq-pjrm-6p5r

    in-toto-golang and in-toto-python have inconsistent negation behavior

    ### Impact _What kind of vulnerability is it? Who is impacted?_ in-toto-golang and in-toto-python both support glob patterns in artifact rules to indicate the artifacts that a rule applies to. Both support negations in character classes to indicate what shoul…

    github.com/in-toto/in-toto-golang Go
  • Medium 5.6
    CVE-2021-41087

    Improperly Implemented path matching for in-toto-golang

    in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations …

    in-toto in-toto-golang github.com/in-toto/in-toto-golang Go