CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:NCVE-2020-15163
High (8.2) in linuxfoundation the update framework. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in tuf 0.12.0.
Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-345, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:the_update_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f8mr-jv2c-v8mg | PyPI | tuf | <0.12.0 | 0.12.0 |
| PYSEC-2020-145 | PyPI | tuf | <0.12.0 | 0.12.0 |
References
- https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7
- https://github.com/theupdateframework/tuf/pull/885
- https://github.com/theupdateframework/tuf/releases/tag/v0.12.0
- https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg
- https://pypi.org/project/tuf