Advisories for Pypi/Tuf package

The security of both a TUF client and repository implementations depend on the concept of trusted Metadata objects verifying the signatures over other Metadata that it delegates to. This verification process uses Targets.get_delegated_role(delegated_role: str) to find the delegation information. tuf.api.metadata.Targets.get_delegated_role() should ensure that the given delegated_rolename is actually a name of a role that is delegated by that Targets, but in the case of "succinct delegation" this does not happen. …

The function _verify_root_self_signed(), introduced in v0.14.0, and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the threshold for new key self-signatures required during root metadata update. A scenario where this attack could be relevant is amazingly unlikely in practice to the point where …

python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (tuf/client and tuf/ngclient), there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to get_one_valid_targetinfo(). It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie ../../name.json). The impact is mitigated by a few …

Python TUF (The Update Framework) reference implementation it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed and newer.

TUF (aka The Update Framework) allows Uncontrolled Resource Consumption.

TUF (aka The Update Framework) has Improper Verification of a Cryptographic Signature.