Read the docs
TI-2020-11935 Aliases CVE-2020-15163GHSA-f8mr-jv2c-v8mg

Invalid root may become trusted root in The Update Framework (TUF)

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

Why it matters now

EPSS 0.0067 52nd percentileScored 2026-11-07
Fix Fixed tuf (theupdateframework): 0.12tuf (PyPI): 0.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
theupdateframeworktufbefore 0.120.12Patch availableCNA
—tuf (PyPI)before 0.12.00.12.0Patch availableGHSA-f8mr-jv2c-v8mg
  • tuf Vendortheupdateframework Affected before 0.12 Fixed in 0.12 Patch available CNA
  • tuf (PyPI) Vendor— Affected before 0.12.0 Fixed in 0.12.0 Patch available GHSA-f8mr-jv2c-v8mg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:the_update_framework:*:*:*:*:*:*:*:*before 0.12.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:the_update_framework:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·backstage

Remediation

  • Fix · CNA tuf (theupdateframework) Fixed in 0.12
  • Fix · GHSA-f8mr-jv2c-v8mg tuf (PyPI) Fixed in 0.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15163
  2. 2026-10-03 Alias added: GHSA-f8mr-jv2c-v8mg

References

Patch 1

Advisory 4

Other 3

  • TI-2026-19908 go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names CVSS 3.1MEDIUM 4.7
  • TI-2024-31823 Incorrect delegation lookups can make go-tuf download the wrong artifact CVSS 4.0HIGH 8.2
  • TI-2022-11717 No protection against rollback attacks in go-tuf CVSS 3.1HIGH 8.8
  • TI-2021-17970 Client metadata path-traversal in python-tuf CVSS 3.1HIGH 8.7
  • TI-2026-19332 go-tuf affected by client DoS via malformed server response CVSS 3.1HIGH 7.5
  • TI-2026-19333 go-tuf improperly validates the configured threshold for delegations CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences