CVE-2020-15163

Katalog CVE

CVSS 8.2 · High EPSS 0,67%

Kerentanan Incorrect Authorization pada linuxfoundation the update framework. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

Rincian

Terbit di NVD

9 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pypi.org/project/tuf product · advisory vendor
• https://github.com/theupdateframework/tuf/pull/885 patch · advisory pihak ketiga
• https://github.com/theupdateframework/tuf/releases/tag/v0.12.0 advisory pihak ketiga
• https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg advisory pihak ketiga
• https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7 broken link