Vulnerability PYSEC-2020-145
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 years ago
September 09, 2020 at 06:15 PM UTC
No summary available
0.7.5 - 0.12.dev2
0.7.5 - 0.12.dev2
Details
Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 months ago
tuf has platform-dependent delegation path matching
0.7.5 - 6.0.0 GHSA-qp9x-wp8f-qgjj
0.7.5 - 6.0.0 GHSA-qp9x-wp8f-qgjj
Low Risk
2 years ago
tuf's Metadata API: Targets.get_delegated_role() is missing input validation
2.0.0 - 3.1.0 GHSA-77hh-43cm-v8j6
2.0.0 - 3.1.0 GHSA-77hh-43cm-v8j6
Low Risk
4 years ago
Python-TUF vulnerable to incorrect threshold signature computation for new root metadata
0.14.0 - 0.15.0 GHSA-r7vq-6425-j94w
0.14.0 - 0.15.0 GHSA-r7vq-6425-j94w
High Risk
5 years ago
Client metadata path-traversal
0.7.5 - 0.18.1 GHSA-wjw6-2cqr-j4qr
0.7.5 - 0.18.1 GHSA-wjw6-2cqr-j4qr
Unknown
5 years ago
No summary available
0.7.5 - 0.18.1 PYSEC-2021-376
0.7.5 - 0.18.1 PYSEC-2021-376
Impacted packages
Timeline
Published
6 years ago
September 09, 2020 at 06:15 PM UTC
Fixed (0.12.0)
7 years ago
October 15, 2019 at 08:38 AM UTC
Last Modified
3 years ago
November 08, 2023 at 04:02 AM UTC