Man-in-the-Middle (MitM)

tuf is vulnerable to man-in-the-middle attack. An attacker who is able to control the trust chain for future updates by serving multiple new versions of root metadata culminating in a version which has not been correctly signed. The vulnerability exists as the reference implementation incorrectly...

PYSEC-2020-145

Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...

CVE-2020-15163

Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...