PyPI/tuf CVE-2020-6174: critical 9.8, EPSS 0.99%

Incorrect threshold signature computation in TUF

Action: Upgrade tuf to 0.12.2 or later.

pip install tuf==0.12.2

Affected

Fixed versions

Sources

• osv: GHSA-pwqf-9h7j-7mv8
• https://github.com/theupdateframework/tuf/security/advisories/GHSA-pwqf-9h7j-7mv8
• https://nvd.nist.gov/vuln/detail/CVE-2020-6174
• https://github.com/theupdateframework/tuf/pull/974
• https://github.com/theupdateframework/python-tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e
• https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2020-147.yaml
• https://github.com/theupdateframework/tuf
• https://github.com/theupdateframework/tuf/releases/tag/v0.12.2

CVE-2020-6174 · published 2020-08-21T16:25:26Z · modified 2024-11-18T22:58:28.938104Z · JSON