# CVE-2020-6174: PYSEC-2020-147 - TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

Source: https://junglewise.ai/threats/cve-2020-6174-incorrect-threshold-signature-computation-in-tuf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-02-05  
License: CC BY 4.0 with a link back

CVE-2020-6174 · Severity: low · CVSS 3.1 · Published 2020-02-05

TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

Technologies: [tuf (PyPI)](https://junglewise.ai/threats/technologies/tuf). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-6174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-6174 being exploited in the wild.

**How severe is CVE-2020-6174?** Low severity, with a CVSS score of 3.1, published 5 February 2020.

**Which products and versions are affected?** tuf (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.2.

**Is there a fix for CVE-2020-6174?** Yes. tuf (PyPI): upgrade to 0.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2020-6174?** Check whether you run tuf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tuf (PyPI): upgrade to 0.12.2 or later

  ```sh
  pip install "tuf>=0.12.2"
  ```


## Affected products

- tuf (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.2

## Identifiers

- CVE-2020-6174
- GHSA-pwqf-9h7j-7mv8
- PYSEC-2020-147

## Related threats

- [theupdateframework python-tuf improper case sensitivity in delegation matching](https://junglewise.ai/threats/theupdateframework-python-tuf-improper-case-sensitivity-in-delegation-4289ebd1)
- [tuf's Metadata API: Targets.get_delegated_role() is missing input validation](https://junglewise.ai/threats/tuf-s-metadata-api-targets-get-delegated-role-is-missing-input-88281f97)
- [Python-TUF vulnerable to incorrect threshold signature computation for new root metadata](https://junglewise.ai/threats/python-tuf-vulnerable-to-incorrect-threshold-signature-computation-for-042f316e)
- [Client metadata path-traversal](https://junglewise.ai/threats/cve-2021-41131-client-metadata-path-traversal)
- [Invalid root may become trusted root in The Update Framework (TUF)](https://junglewise.ai/threats/cve-2020-15163-invalid-root-may-become-trusted-root-in-the-update-framework-tuf)