in-toto

in-toto in-toto는 소프트웨어 공급망의 무결성을 보호하기 위한 프레임워크를 제공합니다. 체인의 각 작업이 계획된 대로, 승인된 담당자에 의해서만 수행되며, 제품이 전달 과정에서 변조되지 않았는지 검증합니다. in-toto는 프로젝트 소유자 가 레이아웃layout을 생성하도록 요구합니다. 레이아웃은 소프트웨어 공급망의 단계step 시퀀스와 이러한 단계를 수행하도록 승인된 기능 담당자functionary를 나열합니다. 기능 담당자가 단계를 수행하면 in-toto는 사용된 명령과 관련 파일에 대한 정보를 수집하여 링크li...

SUSE CVE-2023-32076

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...

in-toto vulnerable to Configuration Read From Local Directory

Impact The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification 1. Among the files read is .intotorc which is a hidden file in the directory in which in-tot...

GHSA-WC64-C5RV-32PF in-toto vulnerable to Configuration Read From Local Directory

Impact The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification 1. Among the files read is .intotorc which is a hidden file in the directory in which in-tot...

CVE-2023-32076

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...

Design/Logic Flaw

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...

CVE-2023-32076

Summary of CVE-2023-32076 (in-toto) : The vulnerability affects in-toto up to version 1.4.0, where the framework reads configuration from XDG directories and includes the hidden file .in_totorc. If an attacker controls inputs to a supply chain step, they can inject a crafted .in_totorc with exclu...

CVE-2023-32076 in-toto vulnerable to Configuration Read From Local Directory

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...

CVE-2023-32076 in-toto vulnerable to Configuration Read From Local Directory

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...