CVE-2021-41150

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is...

CVE-2021-41150

creationtimestamp| type| source ---|---|--- 2021-10-20 00:33:25+00:00| seen| https://t.me/cibsecurity/30845...

tough-kms (>=0.2.0 <=0.3.3), tough-ssm (>=0.5.0 <=0.6.3) +1 more potentially affected by CVE-2021-41150 via tough (>=0.10.0 <=0.11.3)

tough CARGO version =0.10.0, =0.2.0, =0.5.0, =0.6.0, =0.6.4 Source cves: CVE-2021-41150 Source advisory: OSV:GHSA-R56Q-VV3C-6G9C...

CVE-2021-41150 Improper sanitization of delegated role names in tough

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is...

CVE-2021-41150

CVE-2021-41150 affects the Tough Rust library (pre-0.12.0). The issue is improper sanitization of delegated role names when caching or loading a repository, allowing files ending with .json to be overwritten with role metadata anywhere on the system. This is caused by insufficient handling during...