Improper Handling of Case Sensitivity Affecting tuf package, versions [,7.0.0)

tuf is a secure updater framework for Python.

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to platform-dependent behavior in the DelegatedRole._is_target_in_pathpattern function. An attacker can bypass intended access restrictions by exploiting case-insensitive path pattern matching on Windows systems when the repository is configured with case-colliding delegation path patterns and the attacker controls one of the delegated roles.

Note:

This is only exploitable if the client is running on Windows, the repository contains delegations with path patterns differing only in case, and the attacker-controlled role is visited before the legitimate role in the delegation order.

• GitHub Advisory
• GitHub Commit
• GitHub Release