The_update_framework - Vulncode-DB

Repositories	Unknown: This might be proprietary software.
#Vulnerabilities	4

Date	Id	Summary	Products	Score
2020-09-09	CVE-2020-15163	Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.	The_update_framework	8.2
2021-10-19	CVE-2021-41131	python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects...	The_update_framework	8.7
2020-02-05	CVE-2020-6174	TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.	The_update_framework	N/A
2020-01-14	CVE-2020-6173	TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.	The_update_framework	N/A