Vulnerability	Vulnerable Version
L Improper Verification of Cryptographic Signature tuf is a secure updater framework for Python. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the `Targets.get_delegated_role` process, when using `tuf.api.metadata`. An attacker can produce incorrect verification results by convincing a Metadata API user to invoke this process with a `delegated_role` argument that is not actually delegated by the `Targets`, while using succinct delegation. This vulnerability does not impact users following the expected client workflow, as the delegated role name is derived from the trusted delegating `Targets` itself. Moreover, actual signature verification is not bypassed since the verified metadata must still be correctly signed by the keys specified in the delegating role. How to fix Improper Verification of Cryptographic Signature? Upgrade `tuf` to version 3.1.1 or higher.	[2.0.0,3.1.1)

Improper Verification of Cryptographic Signature

tuf is a secure updater framework for Python.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the Targets.get_delegated_role process, when using tuf.api.metadata. An attacker can produce incorrect verification results by convincing a Metadata API user to invoke this process with a delegated_role argument that is not actually delegated by the Targets, while using succinct delegation. This vulnerability does not impact users following the expected client workflow, as the delegated role name is derived from the trusted delegating Targets itself. Moreover, actual signature verification is not bypassed since the verified metadata must still be correctly signed by the keys specified in the delegating role.

How to fix Improper Verification of Cryptographic Signature?

Upgrade tuf to version 3.1.1 or higher.

[2.0.0,3.1.1)

Go back to all versions of this package