Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: AWS Component: Tough Clear all filters
TI-2026-06100 CVE-2026-6968

Multiple Path Traversal Variants in awslabs/tough

Priority LOW 32

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00533 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-22
TI-2026-06099 CVE-2026-6967 · GHSA-4v58-8p28-2rq3

Missing Delegated Metadata Validation in awslabs/tough

Priority LOW 31

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integ…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00253 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-345
TI-2026-06098 CVE-2026-6966 · GHSA-8m7c-8m39-rv4x

Signature Threshold Bypass in awslabs/tough Delegated Roles

Priority LOW 31

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplic…

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00283 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-347
TI-2025-02522 CVE-2025-2887 · GHSA-q6r9-r9pw-4cf7

Failure to detect delegated target rollback in tough

Priority LOW 26

During a target rollback, the client fails to detect the rollback for delegated targets.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-27 Fixed in 0.20.0 CWE-1025
TI-2025-02521 CVE-2025-2886 · GHSA-v4wr-j3w6-mxqc

Terminating targets role delegations are not respected in tough

Priority LOW 26

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-27 Fixed in 0.20.0 CWE-670
TI-2025-02520 CVE-2025-2885 · GHSA-5vmp-m5v2-hx47

Root metadata version not validated in tough

Priority LOW 26

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by…

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-27 Fixed in 0.20.0 CWE-1288
TI-2021-17989 CVE-2021-41150 · GHSA-r56q-vv3c-6g9c

Improper sanitization of delegated role names in tough

Priority LOW 38

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.01281 Published 2021-10-19 Fixed in 0.12.0 CWE-22
TI-2021-17988 CVE-2021-41149 · GHSA-x3r5-q6mj-m485

Improper sanitization of target names in tough

Priority LOW 38

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.01113 Published 2021-10-19 Fixed in 0.12.0 CWE-22
TI-2020-11868 CVE-2020-15093 · GHSA-5q2r-92f9-4m49

Improper verification of signature threshold in tough

Priority MEDIUM 40

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01357 Published 2020-07-09 Fixed in 0.7.1 CWE-347