PT-2021-23130 · Tough · Tough

Jkuf · Published 2021-10-19 · Updated 2021-10-26 · CVE-2021-41150

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.12.0

Description The tough library does not properly sanitize delegated role names when caching a repository or loading a repository from the filesystem. This can lead to files ending with the .json extension being overwritten with role metadata anywhere on the system. The issue is mitigated by the fact that it only affects implementations that allow arbitrary rolename selection for delegated targets metadata, and the attack requires the ability to insert new metadata for the path-traversing role and get the role delegated by an existing targets metadata. The written file content is heavily restricted since it needs to be a valid, signed targets file, and the file extension is always .json.

Recommendations For tough versions prior to 0.12.0, update to version 0.12.0 or newer to resolve the issue. As a temporary workaround, consider restricting the allowed character set for rolenames or storing metadata in files named in a way that is not vulnerable, although these approaches require code changes.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-41150

GHSA-R56Q-VV3C-6G9C

GHSA-WJW6-2CQR-J4QR

Affected Products

Tough

References · 14

• https://github.com/awslabs/tough/commit/1809b9bd1106d78a51fbea3071aa97a3530bac9a · Patch
• https://osv.dev/vulnerability/GHSA-r56q-vv3c-6g9c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41150 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41131 · Security Note
• https://osv.dev/vulnerability/GHSA-wjw6-2cqr-j4qr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41150 · Vendor Advisory
• https://github.com/theupdateframework/python-tuf · Note
• https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr · Note
• https://github.com/theupdateframework/python-tuf/commit/4ad7ae48fda594b640139c3b7eae21ed5155a102 · Note
• https://github.com/theupdateframework/python-tuf/issues/1527 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2021-376.yaml · Note
• https://github.com/awslabs/tough · Note
• https://github.com/awslabs/tough/security/advisories/GHSA-r56q-vv3c-6g9c · Note
• https://t.me/cibsecurity/30845 · Telegram Post