PYSEC-2020-147

TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...

CVE-2020-6174

The CVE-2020-6174 issue affects the tough library (Rust/crates.io) prior to version 0.7.1, where signatures’ threshold verification is broken. Specifically, the vulnerability allows an attacker to duplicate a valid signature and circumvent the minimum threshold required for metadata validity. A f...

PYSEC-2020-146

TUF aka The Update Framework 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption...

CVE-2020-6173

CVE-2020-6173 affects The Update Framework (TUF) versions 0.7.2–0.12.1, with Uncontrolled Resource Consumption leading to client DoS. The issue arises when an attacker with repository file access can modify metadata and create many invalid signatures, delaying clients during signature verificatio...