awslabs Vulnerabilities and Affected Products
Vulnerabilities associated with tough.
Products
Clear product- tough3 vulnerabilities
- sandbox-accounts-for-events2 vulnerabilities
- aws-dataall1 vulnerability
- aws-deployment-framework1 vulnerability
- aws-sdk-rust1 vulnerability
- fhir-works-on-aws-authz-smart1 vulnerability
- sockeye1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-41150HIGH | Improper sanitization of delegated role names in toughTough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known. CWE-22Oct 19, 2021 | CVSS8.2v3.1 | EPSS1.28% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-41149HIGH | Improper sanitization of target names in toughTough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known. CWE-22Oct 19, 2021 | CVSS8.2v3.1 | EPSS1.11% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-15093HIGH | Improper verification of signature threshold in toughThe tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation. CWE-347Jul 9, 2020 | CVSS8.6v3.1 | EPSS1.36% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |