Homepage
About Snyk

tuf@3.0.0 vulnerabilities

A secure updater framework for Python

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the tuf package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • L
Improper Verification of Cryptographic Signature

tuf is a secure updater framework for Python.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the Targets.get_delegated_role process, when using tuf.api.metadata. An attacker can produce incorrect verification results by convincing a Metadata API user to invoke this process with a delegated_role argument that is not actually delegated by the Targets, while using succinct delegation. This vulnerability does not impact users following the expected client workflow, as the delegated role name is derived from the trusted delegating Targets itself. Moreover, actual signature verification is not bypassed since the verified metadata must still be correctly signed by the keys specified in the delegating role.

How to fix Improper Verification of Cryptographic Signature?

Upgrade tuf to version 3.1.1 or higher.

[2.0.0,3.1.1)
Go back to all versions of this package