Количество 2
Количество 2
CVE-2026-6966
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
GHSA-8m7c-8m39-rv4x
awslabs/tough Delegated Roles have a Signature Threshold Bypass
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-6966 Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0. | CVSS3: 5.3 | 0% Низкий | 3 месяца назад |
| GHSA-8m7c-8m39-rv4x awslabs/tough Delegated Roles have a Signature Threshold Bypass | CVSS3: 5.3 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу