CVE-2021-41149

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...

tough-kms (>=0.2.0 <=0.3.3), tough-ssm (>=0.5.0 <=0.6.3) +1 more potentially affected by CVE-2021-41149 via tough (>=0.10.0 <=0.11.3)

tough CARGO version =0.10.0, =0.2.0, =0.5.0, =0.6.0, =0.6.4 Source cves: CVE-2021-41149 Source advisory: OSV:GHSA-X3R5-Q6MJ-M485...

CVE-2021-41149 Improper sanitization of target names in tough

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...

CVE-2021-41149

The CVE-2021-41149 issue concerns the tough Rust library (pre-0.12.0) where target names are not properly sanitized when caching a repository or saving targets to an output directory. This can allow files to be overwritten with arbitrary content anywhere on the system. A fix is available in versi...