GitHub Advisoryadvisory · PyPI

GHSA-2828-9vh6-9m6j Client Denial of Service on TUF

MEDIUM Published 2020-08-21 Modified 2024-11-18 Official page ↗
Aliases
CVE-2020-6173
Ecosystem
PyPI
Packages
tuf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2020-08-21

Affected packages

• PyPI tuf: >= 0.7.2, < 0.12.2 → fixed in 0.12.2

Description

Impact An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted. The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue. Patches No fix exists for this issue. Workarounds No workarounds are known for this issue. References • CVE-2020-6173 • Issue #973

Related

Alias · CVE (1)

  • CVE-2020-6173 TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References