Executive brief
tough cyclic delegation graphs are not detected
Affected products
- crates.io tough
Junglewise Threat Intelligence
tough cyclic delegation graphs are not detected
Severity: low · CVSS 3.1 · Published 2025-03-28
Technologies: tough (crates.io). Vendors: crates.io.
Related threats
- awslabs/tough is Missing Delegated Metadata Validation
- awslabs/tough Delegated Roles have a Signature Threshold Bypass
- tough terminating targets role delegations are not respected
- tough root metadata version is not checked for sequential versioning
- tough timestamp metadata is cached when it fails snapshot rollback check