in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various
    directories and allows users to configure the behavior of the framework. The files are from directories
    following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is
    `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the
    inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that
    includes the necessary exclude patterns and settings. RC files are widely used in other systems and
    security issues have been discovered in their implementations as well. Maintainers found in their
    conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As
    none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or
    CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module
    has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox
    functionary code as a security measure. (CVE-2023-32076)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various     directories and allows users to configure the behavior of the framework. The files are from directories     following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is     `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the     inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that     includes the necessary exclude patterns and settings. RC files are widely used in other systems and     security issues have been discovered in their implementations as well. Maintainers found in their     conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As     none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or     CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module     has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox     functionary code as a security measure. (CVE-2023-32076)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
421670	SCA: security update for in-toto (GHSA-wc64-c5rv-32pf)	Tenable Cloud Security	SCA Checks	medium
421670	SCA: security update for in-toto (GHSA-wc64-c5rv-32pf)	Tenable Self-Hosted Container Security	SCA Checks	medium
226856	Linux Distros Unpatched Vulnerability : CVE-2023-32076	Nessus	Misc.	medium

Detections

Analytics

CVE-2023-32076

medium

Tenable Plugins

medium

medium

medium