https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 07:58:57 +0000 https://vulnerability.circl.lu/vuln/cve-2020-6174 <p>TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.</p> <p>TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.</p> https://vulnerability.circl.lu/vuln/cve-2020-6174 https://vulnerability.circl.lu/vuln/ghsa-pwqf-9h7j-7mv8 <p><strong>Affected:</strong> PyPI: tuf</p> <p>### Impact Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid.</p> <p>The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.</p> <p>### Patches A [fix](https://github.com/theupdateframework/tuf/pull/974) is available in version [0.12.2](https://github.com/theupdateframework/tuf/releases/tag/v0.12.2) or newer.</p> <p>### Workarounds No workarounds are known for this issue.</p> <p>### References * [CVE-2020-6174](https://nvd.nist.gov/vuln/detail/CVE-2020-6174) * Pull request resolving the issue [PR 974](https://github.com/theupdateframework/tuf/pull/974)</p> <p><strong>Affected:</strong> PyPI: tuf</p> <p>### Impact Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid.</p> <p>The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.</p> <p>### Patches A [fix](https://github.com/theupdateframework/tuf/pull/974) is available in version [0.12.2](https://github.com/theupdateframework/tuf/releases/tag/v0.12.2) or newer.</p> <p>### Workarounds No workarounds are known for this issue.</p> <p>### References * [CVE-2020-6174](https://nvd.nist.gov/vuln/detail/CVE-2020-6174) * Pull request resolving the issue [PR 974](https://github.com/theupdateframework/tuf/pull/974)</p> https://vulnerability.circl.lu/vuln/ghsa-pwqf-9h7j-7mv8 https://vulnerability.circl.lu/vuln/pysec-2020-147 <p><strong>Affected:</strong> PyPI: tuf</p> <p>TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.</p> <p><strong>Affected:</strong> PyPI: tuf</p> <p>TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.</p> https://vulnerability.circl.lu/vuln/pysec-2020-147