PT-2021-23115 · Unknown · Python Tuf
Jku
·
Published
2021-10-19
·
Updated
2021-10-22
·
CVE-2021-41131
CVSS v2.0
8.8
High
| Vector | AV:N/AC:M/Au:N/C:N/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
python-tuf versions prior to 0.19
Description
The issue is a path traversal vulnerability that can overwrite files ending in
.json anywhere on the client system when calling get one valid targetinfo(). This occurs because the rolename is used to form the filename and may contain path traversal characters, such as ../../name.json. The impact is mitigated by the fact that it only affects implementations allowing arbitrary rolename selection for delegated targets metadata, requires the ability to insert new metadata and get the role delegated, and the written file content must be a valid, signed targets file with a .json extension.Recommendations
For versions prior to 0.19, update to version 0.19 or newer to resolve the issue. As a temporary workaround, consider restricting the allowed character set for rolenames or storing metadata in files named in a way that is not vulnerable, although these approaches require modifying python-tuf.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Python Tuf