pysec - pysec-2020-146

PYSEC-2020-146

Vulnerability from pysec - Published: 2020-01-14 19:15 - Updated: 2020-01-21 19:55

Details

TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

Impacted products

Name	purl
tuf	pkg:pypi/tuf

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tuf",
        "purl": "pkg:pypi/tuf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.5"
            },
            {
              "fixed": "0.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.7.5",
        "0.9.8",
        "0.9.9",
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.11.dev0",
        "0.11.0",
        "0.11.1",
        "0.11.2.dev1",
        "0.11.2.dev2",
        "0.11.2.dev3",
        "0.12.dev0",
        "0.12.dev1",
        "0.12.dev2",
        "0.12.0",
        "0.12.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-6173",
    "GHSA-2828-9vh6-9m6j"
  ],
  "details": "TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.",
  "id": "PYSEC-2020-146",
  "modified": "2020-01-21T19:55:00Z",
  "published": "2020-01-14T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/theupdateframework/tuf/issues/973"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theupdateframework/tuf/commits/develop"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-2828-9vh6-9m6j"
    }
  ]
}

CVE-2020-6173 (GCVE-0-2020-6173)

Vulnerability from cvelistv5 – Published: 2020-01-14 18:50 – Updated: 2024-08-04 08:55

Summary

TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://github.com/theupdateframework/tuf/commits…	x_refsource_MISC
	https://github.com/theupdateframework/tuf/issues/973	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:55:22.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/theupdateframework/tuf/commits/develop"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/theupdateframework/tuf/issues/973"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-14T18:50:31",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theupdateframework/tuf/commits/develop"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theupdateframework/tuf/issues/973"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-6173",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/theupdateframework/tuf/commits/develop",
              "refsource": "MISC",
              "url": "https://github.com/theupdateframework/tuf/commits/develop"
            },
            {
              "name": "https://github.com/theupdateframework/tuf/issues/973",
              "refsource": "MISC",
              "url": "https://github.com/theupdateframework/tuf/issues/973"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-6173",
    "datePublished": "2020-01-14T18:50:31",
    "dateReserved": "2020-01-08T00:00:00",
    "dateUpdated": "2024-08-04T08:55:22.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-2828-9VH6-9M6J

Vulnerability from github – Published: 2020-08-21 16:25 – Updated: 2024-11-18 22:40

Summary

Client Denial of Service on TUF

Details

Impact

An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

Patches

No fix exists for this issue.

Workarounds

No workarounds are known for this issue.

References

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tuf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.2"
            },
            {
              "fixed": "0.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-6173"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-21T16:19:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nAn attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.\n\nThe tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.\n\n### Patches\nNo fix exists for this issue. \n\n### Workarounds\nNo workarounds are known for this issue.\n\n### References\n* [CVE-2020-6173](https://nvd.nist.gov/vuln/detail/CVE-2020-6173)\n* [Issue #973](https://github.com/theupdateframework/tuf/issues/973)",
  "id": "GHSA-2828-9vh6-9m6j",
  "modified": "2024-11-18T22:40:00Z",
  "published": "2020-08-21T16:25:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/theupdateframework/tuf/security/advisories/GHSA-2828-9vh6-9m6j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6173"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theupdateframework/tuf/issues/973"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2020-146.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/theupdateframework/tuf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theupdateframework/tuf/commits/develop"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Client Denial of Service on TUF"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2020-146

CVE-2020-6173 (GCVE-0-2020-6173)

GHSA-2828-9VH6-9M6J

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature