Lucene search

GitHub_MCVELIST:CVE-2021-41149

HistoryOct 19, 2021 - 6:00 p.m.

CVE-2021-41149 Improper sanitization of target names in tough

2021-10-1918:00:12

CWE-22

GitHub_M

www.cve.org

cve-2021-41149

tough library

rust

update framework

tuf repositories

sanitization vulnerability

arbitrary content overwrite

version 0.12.0 fix

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

32.5%

JSON

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.

CNA Affected

[
  {
    "product": "tough",
    "vendor": "awslabs",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.12.0"
      }
    ]
  }
]

References

github.com/awslabs/tough/commit/1809b9bd1106d78a51fbea3071aa97a3530bac9a

github.com/awslabs/tough/security/advisories/GHSA-x3r5-q6mj-m485

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

32.5%

JSON

Related for CVELIST:CVE-2021-41149