p PatchFirst

CVE-2020-15163

CVE-2020-15163 · Invalid root may become trusted root in The Update Framework (TUF)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • tuf

    Versions
    • < 0.12: Affected

    No fix published

  • tuf PyPI

    Versions
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.11.0
    • 0.11.1
    • 0.11.2.dev1
    • 0.11.2.dev2
    • 0.11.2.dev3
    • 0.11.dev0
    • 0.12.dev0
    • 0.12.dev1
    • 0.12.dev2
    • 0.7.5
    • 0.9.8
    • 0.9.9
    Affected ranges
    • ECOSYSTEM: < 0.12.0

    Update to 0.12.0

  • tuf PyPI

    Versions
    • 0.7.5
    • 0.9.8
    • 0.9.9
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.11.dev0
    • 0.11.0
    • 0.11.1
    • 0.11.2.dev1
    • 0.11.2.dev2
    • 0.11.2.dev3
    • 0.12.dev0
    • 0.12.dev1
    • 0.12.dev2
    Affected ranges
    • GIT: < 3d342e648fbacdf43a13d7ba8886aaaf07334af7
    • ECOSYSTEM: < 0.12.0

    Update to 0.12.0

Original sources

Check your server →