103 matches found
PYSEC-2020-145
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
PYSEC-2020-145
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
Design/Logic Flaw
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
CVE-2020-15163
CVE-2020-15163 affects the Python TUF (The Update Framework) reference implementation prior to 0.12, which could incorrectly trust a previously downloaded root metadata file that failed verification. An attacker capable of serving multiple new root-metadata versions (MITM) could culminate in a ve...
CVE-2020-15163 Invalid root may become trusted root in The Update Framework (TUF)
Python TUF The Update Framework reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a...
GHSA-F8MR-JV2C-V8MG Invalid root may become trusted root in The Update Framework (TUF)
Impact The Python TUF reference implementation tuf0.12 will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata i.e. by a man-in-the-middle attack culminating i...
CVE-2020-6174
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
CVE-2020-6174
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
PYSEC-2020-147
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
Input validation
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
PYSEC-2020-147
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
CVE-2020-6174
The CVE-2020-6174 issue affects the tough library (Rust/crates.io) prior to version 0.7.1, where signatures’ threshold verification is broken. Specifically, the vulnerability allows an attacker to duplicate a valid signature and circumvent the minimum threshold required for metadata validity. A f...
CVE-2020-6174
TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...
PT-2020-18981
Name of the Vulnerable Software and Affected Versions TUF aka The Update Framework versions prior to 0.7.1 TUF aka The Update Framework through 0.12.1 Description The issue is related to improper verification of cryptographic signatures, allowing someone with access to a valid signing key to crea...
CVE-2020-6173
TUF aka The Update Framework 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption...
CVE-2020-6173
TUF aka The Update Framework 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption...
PYSEC-2020-146
TUF aka The Update Framework 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption...
Design/Logic Flaw
TUF aka The Update Framework 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption...
PYSEC-2020-146
TUF aka The Update Framework 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption...
CVE-2020-6173
CVE-2020-6173 affects The Update Framework (TUF) versions 0.7.2–0.12.1, with Uncontrolled Resource Consumption leading to client DoS. The issue arises when an attacker with repository file access can modify metadata and create many invalid signatures, delaying clients during signature verificatio...