Описание
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Ссылки
- Vendor Advisory
- Product
- Product
- Release Notes
- Release Notes
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.22.0 (исключая)Версия до 0.15.0 (исключая)
Одно из
cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*
cpe:2.3:a:amazon:tuftool:*:*:*:*:*:rust:*:*
EPSS
Процентиль: 18%
0.00262
Низкий
5.3 Medium
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-347
Связанные уязвимости
CVSS3: 5.3
github
3 месяца назад
awslabs/tough Delegated Roles have a Signature Threshold Bypass
EPSS
Процентиль: 18%
0.00262
Низкий
5.3 Medium
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-347