PT-2020-14178 · Tough · Tough Library

Erik Maclean · Published 2020-07-09 · Updated 2021-10-26 · CVE-2020-15093

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions tough library versions prior to 0.7.1

Description The issue arises from the tough library's failure to properly verify the uniqueness of keys in the signatures provided, allowing an attacker with access to a valid signing key to create multiple valid signatures. This can be used to circumvent the requirement for a minimum threshold of unique signatures before metadata is considered valid. A fix is available in version 0.7.1.

Recommendations For versions prior to 0.7.1, update to version 0.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the signing keys to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-15093

GHSA-5Q2R-92F9-4M49

RUSTSEC-2020-0024

Affected Products

Tough Library

References · 11

• https://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e · Patch
• https://github.com/theupdateframework/tuf/pull/974 · Patch
• https://osv.dev/vulnerability/CVE-2020-15093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15093 · Security Note
• https://osv.dev/vulnerability/GHSA-5q2r-92f9-4m49 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0024 · Vendor Advisory
• https://github.com/awslabs/tough · Note
• https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49 · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0024.html · Note
• https://crates.io/crates/tough · Note
• https://t.me/cvenotify/4960 · Telegram Post