# CVE-2020-15163: Invalid root may become trusted root in The Update Framework (TUF)

Source: https://junglewise.ai/threats/cve-2020-15163-invalid-root-may-become-trusted-root-in-the-update-framework-tuf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-09  
License: CC BY 4.0 with a link back

CVE-2020-15163 · Severity: low · CVSS 3.1 · Published 2020-09-09

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

Technologies: [tuf (PyPI)](https://junglewise.ai/threats/technologies/tuf). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-15163 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15163 being exploited in the wild.

**How severe is CVE-2020-15163?** Low severity, with a CVSS score of 3.1, published 9 September 2020.

**Which products and versions are affected?** tuf (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.0, GIT:introduced=0,fixed=3d342e648fbacdf43a13d7ba8886aaaf07334af7|ECOSYSTEM:introduced=0,fixed=0.12.0.

**Is there a fix for CVE-2020-15163?** Yes. tuf (PyPI): upgrade to 0.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2020-15163?** Check whether you run tuf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tuf (PyPI): upgrade to 0.12.0 or later

  ```sh
  pip install "tuf>=0.12.0"
  ```


## Affected products

- tuf (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.0, GIT:introduced=0,fixed=3d342e648fbacdf43a13d7ba8886aaaf07334af7|ECOSYSTEM:introduced=0,fixed=0.12.0

## Identifiers

- CVE-2020-15163
- GHSA-f8mr-jv2c-v8mg
- PYSEC-2020-145

## Related threats

- [theupdateframework python-tuf improper case sensitivity in delegation matching](https://junglewise.ai/threats/theupdateframework-python-tuf-improper-case-sensitivity-in-delegation-4289ebd1)
- [tuf's Metadata API: Targets.get_delegated_role() is missing input validation](https://junglewise.ai/threats/tuf-s-metadata-api-targets-get-delegated-role-is-missing-input-88281f97)
- [Python-TUF vulnerable to incorrect threshold signature computation for new root metadata](https://junglewise.ai/threats/python-tuf-vulnerable-to-incorrect-threshold-signature-computation-for-042f316e)
- [Client metadata path-traversal](https://junglewise.ai/threats/cve-2021-41131-client-metadata-path-traversal)
- [PYSEC-2020-147 - TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.](https://junglewise.ai/threats/cve-2020-6174-incorrect-threshold-signature-computation-in-tuf)