What is CVE-2021-41087?

CVE-2021-41087 is a medium-severity vulnerability in In-Toto In-Toto-Golang, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.6/10. Published 2021-09-21.

How severe is CVE-2021-41087?

Medium severity. CVSS v3 base score is 5.6 out of 10.

Path Traversal in In-Toto In-Toto-Golang

CVE-2021-41087

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.

EPSS: 0.004 (35.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N.

Affected products

In-toto In-toto-golang — versions < 0.3.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-41087?: CVE-2021-41087 is a medium-severity vulnerability in In-Toto In-Toto-Golang, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.6/10. Published 2021-09-21.
How severe is CVE-2021-41087?: Medium severity. CVSS v3 base score is 5.6 out of 10.