Approved changes feed: RSS · Atom
cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*
part: a version: * update: *
| Vendor | Amazon (0ed129a9-8e26-53dc-aefe-55957e638c30) |
|---|---|
| Product | Tough (272ab829-058c-5a2c-8141-a87ed161f327) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | rust |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6968 |
vulnerable | 2026-06-08 08:07:05.215351 |
Multiple Path Traversal Variants in awslabs/tough
MEDIUM (5.9)
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Published: 2026-04-24T19:44:44.835Z
Updated: 2026-04-24T20:10:00.800Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-6967 |
vulnerable | 2026-06-08 08:07:05.214669 |
Missing Delegated Metadata Validation in awslabs/tough
MEDIUM (5.9)
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Published: 2026-04-24T19:41:43.460Z
Updated: 2026-04-24T20:13:20.016Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-6966 |
vulnerable | 2026-06-08 08:07:05.213179 |
Signature Threshold Bypass in awslabs/tough Delegated Roles
MEDIUM (5.3)
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Published: 2026-04-24T19:38:24.907Z
Updated: 2026-04-24T20:15:28.842Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2888 |
vulnerable | 2026-06-08 07:16:58.596488 |
Improper timestamp caching during snapshot rollback in tough
During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Published: 2025-03-27T22:23:48.886Z
Updated: 2025-10-14T18:27:20.982Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2887 |
vulnerable | 2026-06-08 07:16:58.596052 |
Failure to detect delegated target rollback in tough
During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Published: 2025-03-27T22:23:04.038Z
Updated: 2025-10-14T18:25:28.087Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2886 |
vulnerable | 2026-06-08 07:16:58.595482 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2885 |
vulnerable | 2026-06-08 07:16:58.595018 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41150 |
vulnerable | 2026-06-08 05:35:19.837308 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41149 |
vulnerable | 2026-06-08 05:35:19.836823 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15093 |
vulnerable | 2026-06-08 05:19:25.247420 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.