{"id":"GHSA-pmwq-pjrm-6p5r","revision":null,"records":[{"revision":"1de493e5333c4648b3f33ca3bb6f1d52","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-pmwq-pjrm-6p5r","aliases":["GO-2026-5547"],"title":"in-toto-golang and in-toto-python have inconsistent negation behavior","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nin-toto-golang and in-toto-python both support glob patterns in artifact rules to indicate the artifacts that a rule applies to. Both support negations in character classes to indicate what should *not* be matched, but they used different operators to indicate the negation. in-toto-python uses `!` while in-toto-golang used `^`. A layout authored with the expectations of one implementation can therefore exhibit different behavior in the other implementation.\n\nThis impacts users in a specific set of circumstances where two different implementations are used to verify the same layout + attestation bundle at different stages of the same pipeline. As a rule of thumb, we advise using a single implementation across all aspects of a pipeline, from layout creation to pipeline execution and verification to prevent this class of bugs.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nin-toto-golang has been updated to use `!` instead of `^` to indicate negation. See https://github.com/in-toto/in-toto-golang/pull/462. This is part of v0.11.0.","state":0,"publishedAt":"2026-05-08T22:24:19+00:00","modifiedAt":"2026-09-10T03:51:06.602952+00:00","affected":[{"ecosystem":"Go","name":"github.com/in-toto/in-toto-golang","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.11.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-pmwq-pjrm-6p5r","https://github.com/in-toto/in-toto-golang/pull/462","https://github.com/in-toto/in-toto-golang/commit/36d782ffb2ca3adbffcdce1fd971c23319dd4469","https://github.com/in-toto/in-toto-golang"],"sourceUrl":"https://github.com/advisories/GHSA-pmwq-pjrm-6p5r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pmwq-pjrm-6p5r","identifiers":["GHSA-pmwq-pjrm-6p5r","GO-2026-5547"]},"retained":false,"historicalAffected":[]},{"revision":"2992e4040487487a9c7a3db4c316f09f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5547","aliases":["GHSA-pmwq-pjrm-6p5r"],"title":"in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang","description":"in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-28T13:59:25.9403936+00:00","affected":[{"ecosystem":"Go","name":"github.com/in-toto/in-toto-golang","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.11.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-pmwq-pjrm-6p5r","https://github.com/in-toto/in-toto-golang/commit/36d782ffb2ca3adbffcdce1fd971c23319dd4469","https://github.com/in-toto/in-toto-golang/pull/462"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5547","license":"OSV · upstream source license applies","key":"osv:GO-2026-5547","identifiers":["GO-2026-5547","GHSA-pmwq-pjrm-6p5r"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5204338+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5204347+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-576973bd2a8c36ed3d013750ca82fcede7b10fe95f071dbe9a6a4dd94759ab84","complete":true,"records":425782,"lastAttemptAt":"2026-11-15T07:30:53.2515651+00:00","lastSuccessAt":"2026-11-15T07:30:53.2350398+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.2515651+00:00","snapshotPublishedAt":"2026-11-15T07:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4b05fe0ee8234cc5b2e7e96afe15a243","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T07:36:18.1892507+00:00","lastSuccessAt":"2026-11-15T07:36:18.2502007+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:36:18.2502007+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5213705+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5213739+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-35abf047bdfe46089a52c4c139c37942","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T07:31:01.665293+00:00","lastSuccessAt":"2026-11-15T05:33:23.837+00:00","error":"12 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T05:33:23.837+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13862,"expectedIdentifiers":13874,"failedIdentifiers":12},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T07:30:53.9403022+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.9403022+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T07:30:53.3921516+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.3921516+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T07:30:54.2664324+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.2664324+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-878f718ccd076f540460423958c8e379b139b997b45858275573ecc4d702fe9a","complete":true,"records":232474,"lastAttemptAt":"2026-11-15T07:30:53.7776854+00:00","lastSuccessAt":"2026-11-15T05:33:06.8241102+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.7776854+00:00","snapshotPublishedAt":"2026-11-15T04:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}