The Update Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:linuxfoundation:the_update_framework:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Linuxfoundation (4b459c90-8cdb-5268-beb4-b69b5fe74234) |
|---|---|
| Product | The Update Framework (17ad522f-b59d-582f-97af-b3cc6eb2cfef) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/theupdateframework/python-tuf |
purl2cpe | 2026-06-01 10:13:20.747586 |
pkg:pypi/tuf |
purl2cpe | 2026-06-01 10:13:20.747588 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-6174 |
vulnerable | 2026-06-08 05:26:44.636918 |
Details available
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
Published: 2020-02-05T15:49:15.000Z
Updated: 2024-08-04T08:55:22.406Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6173 |
vulnerable | 2026-06-08 05:26:44.636532 |
Details available
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
Published: 2020-01-14T18:50:31.000Z
Updated: 2024-08-04T08:55:22.148Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15163 |
vulnerable | 2026-06-08 05:19:25.404120 |
Invalid root may become trusted root in The Update Framework (TUF)
HIGH (8.7)
Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.
Published: 2020-09-09T17:30:19.000Z
Updated: 2024-08-04T13:08:22.456Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.