Aller au contenu
Se connecter
8.6 Élevée

CVE-2020-15093 The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic…

Description

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.

Produits et versions touchés

Produit Versions touchées Corrigé en
tough 0.7 premières → < 0.7.1 0.7.1

Autres CVE de tough

Les 3 CVE de tough →
CVE-2021-41150 Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories 8.2 Élevée CVE-2021-41149 Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories 8.2 Élevée
Suivre cette CVE