91 matches found
CVE-2021-41131
python-tuf is a Python reference implementation of The Update Framework TUF. In both clients tuf/client and tuf/ngclient, there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to getonevalidtargetinfo. It occurs...
CVE-2021-41149
Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...
CVE-2021-41131
python-tuf is a Python reference implementation of The Update Framework TUF. In both clients tuf/client and tuf/ngclient, there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to getonevalidtargetinfo. It occurs...
Path traversal
python-tuf is a Python reference implementation of The Update Framework TUF. In both clients tuf/client and tuf/ngclient, there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to getonevalidtargetinfo. It occurs...
CVE-2021-41149
The CVE-2021-41149 issue concerns the tough Rust library (pre-0.12.0) where target names are not properly sanitized when caching a repository or saving targets to an output directory. This can allow files to be overwritten with arbitrary content anywhere on the system. A fix is available in versi...
CVE-2021-41149 Improper sanitization of target names in tough
Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...
CVE-2021-41131
CVE-2021-41131 affects the Python reference implementation of The Update Framework (python-tuf), specifically the clients in the tuf/client and tuf/ngclient components. A path-traversal flaw allows an attacker to craft a rolename that, on calling get_one_valid_targetinfo(), can cause the overwrit...
Tuf - A Framework For Securing Software Update Systems
This repository is the reference implementation of The Update Framework TUF. It is written in Python and intended to conform to version 1.0 of the TUF specification. This implementation is in use in production systems, but is also intended to be a readable guide and demonstration for those workin...
CVE-2020-15163
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
PYSEC-2020-145
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
Design/Logic Flaw
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
PYSEC-2020-145
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
CVE-2020-15163 Invalid root may become trusted root in The Update Framework (TUF)
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
CVE-2020-15163
CVE-2020-15163 affects the Python TUF (The Update Framework) reference implementation prior to 0.12, which could incorrectly trust a previously downloaded root metadata file that failed verification. An attacker capable of serving multiple new root-metadata versions (MITM) could culminate in a ve...
GHSA-F8MR-JV2C-V8MG Invalid root may become trusted root in The Update Framework (TUF)
Impact The Python TUF reference implementation tuf0.12 will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a man-in-the-middle attack culminating i...
CVE-2020-6174
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
CVE-2020-6174
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
PYSEC-2020-147
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...