GitHub Advisoryadvisory · PyPI

GHSA-pwqf-9h7j-7mv8 Incorrect threshold signature computation in TUF

CRITICAL Published 2020-08-21 Modified 2024-11-18 Official page ↗
Aliases
CVE-2020-6174
Ecosystem
PyPI
Packages
tuf
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Reviewed
2020-08-21

Affected packages

• PyPI tuf: < 0.12.2 → fixed in 0.12.2

Description

Impact Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid. The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue. Patches A fix is available in version 0.12.2 or newer. Workarounds No workarounds are known for this issue. References • CVE-2020-6174 • Pull request resolving the issue PR 974

Related

Alias · CVE (1)

  • CVE-2020-6174 TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References