Skip to content
Sign in
8.6 High

CVE-2020-15093 The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic…

Description

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.

Affected products and versions

Product Affected versions Fixed in
tough 0.7 earliest → < 0.7.1 0.7.1

Other CVEs of tough

The 3 CVEs of tough →
CVE-2021-41150 Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories 8.2 High CVE-2021-41149 Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories 8.2 High
Track this CVE