CVE-2021-41087

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-410888.8Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (star CVE-2021-410896.3Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempti CVE-2021-410907.5Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to ve CVE-2021-410916.3Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data CVE-2021-410927.5Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-CVE-2021-410939.8Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an ac CVE-2021-410944.6Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their CVE-2021-410956.1Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `s CVE-2021-410967.5Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly CVE-2021-410977.5aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in a CVE-2021-410987.5Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on CVE-2021-410997.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to c