CVE-2021-41087: Improperly Implemented path matching in in-toto-golang
Summary
CVE-2021-41087: Improperly Implemented path matching for in-toto-golang. Affects github.com/in-toto/in-toto-golang versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The in-toto-golang package is a Go implementation of the in-toto framework, which provides a way to secure the software supply chain. It allows users to define and verify the integrity of the steps involved in the software development process. The package is designed to ensure that each step in the supply chain is performed by trusted entities and that the artifacts produced are not tampered with. However, a vulnerability has been discovered in the path matching implementation of in-toto-golang, which could allow authenticated attackers to bypass DISALLOW rules and include disallowed artifacts in their attestations.
Vulnerability Detail
The vulnerability in in-toto-golang arises from improperly implemented path matching. Authenticated attackers who are part of a trusted set of users for a layout can create attestations that bypass DISALLOW rules. By using path traversal semantics, such as 'foo' vs 'dir/../foo', an attacker with access to trusted private keys can issue an attestation that includes a disallowed artifact. This can lead to the inclusion of malicious or unauthorized code in the software supply chain, compromising its integrity and security.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
go get github.com/in-toto/in-toto-golang@v0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The effectiveness of exploiting the vulnerability depends on the specific policy applied.
Conclusion
The vulnerability in in-toto-golang's path matching implementation can allow authenticated attackers to include disallowed artifacts in their attestations, compromising the integrity of the software supply chain. Users are advised to update to version 0.3.0 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/in-toto/in-toto-golang →
FAQ
in-toto-golang is a Go implementation of the in-toto framework, which provides a way to secure the software supply chain.
The vulnerability allows authenticated attackers to include disallowed artifacts in their attestations, bypassing DISALLOW rules and potentially compromising the integrity of the software supply chain.
To fix this vulnerability, update to version 0.3.0 or later of the in-toto-golang package.
There are no specific workarounds provided for this vulnerability. The impact depends on the specific policy applied.
For more information, you can open an issue in the in-toto-golang GitHub repository or email the in-toto public mailing list.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/in-toto/in-toto-golang.
