Skip to content
OpenAdvisories

Package · PyPI

in-toto

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium —
    GHSA-jjgp-whrp-gq8m

    in-toto: PGP trust model not (fully) considered

    ### Impact This security advisory lists multiple concerns about how in-toto uses PGP keys. The findings are aggregated here, because they are all eligible to the same mitigation strategy. Note that the findings are rated with different severities (see inline)…

    in-toto PyPI
  • Medium 5.5
    CVE-2023-32076

    in-toto vulnerable to Configuration Read From Local Directory

    in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In…

    in-toto in-toto in-toto in-toto Debian Ubuntu PyPI