Improper Authorization Affecting tuf package, versions [,0.12)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.11% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-TUF-610278
  • published10 Sept 2020
  • disclosed10 Sept 2020
  • creditUnknown

Introduced: 10 Sep 2020

CVE-2020-15163  (opens in a new tab)
CWE-285  (opens in a new tab)

How to fix?

Upgrade tuf to version 0.12 or higher.

Overview

tuf is a secure updater framework for Python.

Affected versions of this package are vulnerable to Improper Authorization. It will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates.

CVSS Scores

version 3.1