in-toto up to 1.4.0 in_totorc external control of setting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in in-toto up to 1.4.0. Affected by this issue is the function in_totorc. This manipulation causes external control of setting. This vulnerability is handled as CVE-2023-32076. It is possible to launch the attack on the local host. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as problematic was found in in-toto up to 1.4.0. Affected by this vulnerability is the function in_totorc. The manipulation with an unknown input leads to a external control of setting vulnerability. The CWE definition for the vulnerability is CWE-15. One or more system settings or configuration elements can be externally controlled by a user. As an impact it is known to affect integrity, and availability. The summary by CVE is:

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.

The weakness was released 05/10/2023 as GHSA-p86f-xmg6-9q4x. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-32076 since 05/01/2023. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 3a21d84f40811b7d191fa7bd17265c1f99599afd is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• in-toto

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• open-source

Website

• Product: https://github.com/in-toto/in-toto/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion