Homepage

tuf@0.15.0 vulnerabilities

A secure updater framework for Python

  • latest version

    5.1.0

  • latest non vulnerable version

    5.1.0

  • first published

    11 years ago

  • latest version published

    2 months ago

  • licenses detected

  • View tuf package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the tuf package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Input Validation

    tuf is a secure updater framework for Python.

    Affected versions of this package are vulnerable to Improper Input Validation by using the function '_verify_root_self_signed()', which would enable a single new root key to satisfy the requirement for new key self-signatures.

    How to fix Improper Input Validation?

    Upgrade tuf to version 0.16.0 or higher.

    [0.14.0,0.16.0)
    • M
    Directory Traversal

    tuf is a secure updater framework for Python.

    Affected versions of this package are vulnerable to Directory Traversal during a call to get_one_valid_targetinfo(), which may lead to an overwrite of files ending in .json. Note: This only affects implementations that allow arbitrary rolename selection for delegated targets metadata.

    How to fix Directory Traversal?

    Upgrade tuf to version 0.19.0 or higher.

    [,0.19.0)
    Go back to all versions of this package