Skip to content
OpenAdvisories

Vendor

in-toto

3 known vulnerabilities.

Products

go-witness 1 in-toto 1 in-toto-golang 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-62375

    go-witness Improper Verification of AWS EC2 Identity Documents

    go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed w…

    in-toto go-witness tkn tekton-chains Wolfi Go
  • Medium 5.5
    CVE-2023-32076

    in-toto vulnerable to Configuration Read From Local Directory

    in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In…

    in-toto in-toto in-toto in-toto Debian Ubuntu PyPI
  • Medium 5.6
    CVE-2021-41087

    Improperly Implemented path matching for in-toto-golang

    in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations …

    in-toto in-toto-golang github.com/in-toto/in-toto-golang Go