Executive brief
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
Affected products
- PyPI tuf
Junglewise Threat Intelligence
CVE-2020-6174: PYSEC-2020-147 - TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
CVE-2020-6174 · Severity: low · CVSS 3.1 · Published 2020-02-05
Technologies: tuf (PyPI). Vendors: PyPI.
Related threats
- theupdateframework python-tuf improper case sensitivity in delegation matching
- PYSEC-2021-376 - python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a
- PYSEC-2020-145 - Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metada
- PYSEC-2020-146 - TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.