GHSA-jjgp-whrp-gq8m: 
Python vulnerability analysis and mitigation

The vulnerability (GHSA-jjgp-whrp-gq8m) affects the in-toto package (pip) versions <= 1.4.0 and involves multiple concerns about how in-toto uses PGP keys. This moderate severity vulnerability was discovered and published on May 10, 2023, with the latest update on May 11, 2023. The issue primarily relates to incomplete implementation of PGP trust model validations in the software (GitHub Advisory).

The vulnerability encompasses three main technical issues: 1) PGP Key Creation Time Not Validated (low severity) - the system doesn't verify if the validity period of a PGP Key is in the future when copying from GnuPG to a layout or during signature verification, 2) PGP Key Revocation Not Considered (medium severity) - the system doesn't check PGP revocation signatures during key copying or signature verification, and 3) PGP Key Usage Flags Not Considered (low severity) - the system doesn't verify PGP usage flags during key operations. The vulnerability is classified under CWE-295 (GitHub Advisory).

The vulnerability could allow a MITM attacker who can manipulate delivered software products to potentially control the system time through NTP manipulation. In a specific scenario, an attacker with control over two expired subkeys with non-overlapping validity periods could set the system time to accept both keys. Additionally, revoked keys might still be accepted for signatures, and keys may be used for signing even when not permitted by their usage flags (GitHub Advisory).

The project has decided not to implement full PGP trust model verification as in-toto doesn't rely on PGP's trust model and shouldn't require consultation with a separate PKI/web-of-trust at verification time. Instead, the preferred mitigation strategy is to verify these properties when exporting a public key from GnuPG and to clarify in documentation that no verification against the PGP trust model is performed afterward. Project owners are responsible for establishing trust by adding PGP public keys to layouts and revoking layouts if keys are no longer trusted (GitHub Advisory).