https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T13:02:54.236620+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2020-6174 CVE-2020-6174 2026-09-30T13:02:56.364295+00:00

TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

 https://vulnerability.circl.lu/vuln/ghsa-pwqf-9h7j-7mv8 GHSA-pwqf-9h7j-7mv8 — Incorrect threshold signature computation in TUF 2026-09-30T13:02:56.364365+00:00

Affected: PyPI: tuf

### Impact Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

### Patches A [fix](https://github.com/theupdateframework/tuf/pull/974) is available in version [0.12.2](https://github.com/theupdateframework/tuf/releases/tag/v0.12.2) or newer.

### Workarounds No workarounds are known for this issue.

### References * [CVE-2020-6174](https://nvd.nist.gov/vuln/detail/CVE-2020-6174) * Pull request resolving the issue [PR 974](https://github.com/theupdateframework/tuf/pull/974)

 https://vulnerability.circl.lu/vuln/pysec-2020-147 PYSEC-2020-147 2026-09-30T13:02:56.364417+00:00

Affected: PyPI: tuf

TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.