CVE-2020-6174: Critical severity linuxfoundation The Update Framework vulnerability
Impact Metadadata signature verification, as used in tuf.client.updater, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid.
The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.
Patches A fix is available in version 0.12.2 or newer.
Workarounds No workarounds are known for this issue.
References CVE-2020-6174 Pull request resolving the issue PR 974
Other sources
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tufto a version that resolves this vulnerability.Fixed in 0.12.2 - Upgrade
Upgrade
theupdateframework/tufto a version that resolves this vulnerability.Fixed in 0.12.2
Event History
Frequently Asked Questions
What is CVE-2020-6174?
CVE-2020-6174 is a vulnerability in the Metadadata signature verification in tuf.client.updater.
What is the impact of CVE-2020-6174?
The impact of CVE-2020-6174 is that an attacker with access to a valid signing key could create multiple valid signatures to meet the threshold for verification.
What is the severity of CVE-2020-6174?
The severity of CVE-2020-6174 is critical with a CVSS score of 9.8.
How can I fix CVE-2020-6174?
To fix CVE-2020-6174, update to version 0.12.2 of the tuf package using pip.
Where can I find more information about CVE-2020-6174?
For more information about CVE-2020-6174, you can refer to the following sources: [GitHub Advisory](https://github.com/theupdateframework/tuf/security/advisories/GHSA-pwqf-9h7j-7mv8) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-6174).