# tuf's Metadata API: Targets.get_delegated_role() is missing input validation

Source: https://junglewise.ai/threats/tuf-s-metadata-api-targets-get-delegated-role-is-missing-input-88281f97  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-16  
License: CC BY 4.0 with a link back

Severity: info · Published 2024-02-16

tuf's Metadata API:  Targets.get_delegated_role() is missing input validation

Technologies: [tuf (PyPI)](https://junglewise.ai/threats/technologies/tuf). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 16 February 2024.

**Which products and versions are affected?** tuf (PyPI) ECOSYSTEM:introduced=2.0.0,fixed=3.1.1.

**Is there a fix for This vulnerability?** Yes. tuf (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run tuf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tuf (PyPI): upgrade to 3.1.1 or later

  ```sh
  pip install "tuf>=3.1.1"
  ```


## Affected products

- tuf (PyPI) ECOSYSTEM:introduced=2.0.0,fixed=3.1.1

## Related threats

- [theupdateframework python-tuf improper case sensitivity in delegation matching](https://junglewise.ai/threats/theupdateframework-python-tuf-improper-case-sensitivity-in-delegation-4289ebd1)
- [Python-TUF vulnerable to incorrect threshold signature computation for new root metadata](https://junglewise.ai/threats/python-tuf-vulnerable-to-incorrect-threshold-signature-computation-for-042f316e)
- [Client metadata path-traversal](https://junglewise.ai/threats/cve-2021-41131-client-metadata-path-traversal)
- [Invalid root may become trusted root in The Update Framework (TUF)](https://junglewise.ai/threats/cve-2020-15163-invalid-root-may-become-trusted-root-in-the-update-framework-tuf)
- [PYSEC-2020-147 - TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.](https://junglewise.ai/threats/cve-2020-6174-incorrect-threshold-signature-computation-in-tuf)