{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-07T15:58:29.221","vulnerabilities":[{"cve":{"id":"CVE-2021-41087","sourceIdentifier":"security-advisories@github.com","published":"2021-09-21T21:15:07.203","lastModified":"2024-11-21T06:25:25.790","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0."},{"lang":"es","value":"in-toto-golang es una implementación del marco de trabajo in-toto para proteger la integridad de la cadena de suministro de software. En las versiones afectadas, los atacantes autenticados que se hacen pasar por funcionarios (es decir, dentro de un conjunto de usuarios confiables para una disposición) pueden crear atestados que pueden omitir las reglas DISALLOW en la misma disposición. Un atacante con acceso a las claves privadas confiables, puede emitir un atestado que contenga un artefacto no permitido incluyendo una semántica de salto de ruta (por ejemplo, foo vs dir/../foo). Una explotación de esta vulnerabilidad depende de la política específica aplicada. El problema ha sido corregido en la versión 0.3.0"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:in-toto:in-toto-golang:*:*:*:*:*:*:*:*","versionEndExcluding":"0.3.0","matchCriteriaId":"E34A0AE8-917E-4FA9-81F7-F7204C722B47"}]}]}],"references":[{"url":"https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}