CVE-2020-6174
First published: Wed Feb 05 2020(Updated: )
### Impact Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid. The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue. ### Patches A [fix](https://github.com/theupdateframework/tuf/pull/974) is available in version [0.12.2](https://github.com/theupdateframework/tuf/releases/tag/v0.12.2) or newer. ### Workarounds No workarounds are known for this issue. ### References * [CVE-2020-6174](https://nvd.nist.gov/vuln/detail/CVE-2020-6174) * Pull request resolving the issue [PR 974](https://github.com/theupdateframework/tuf/pull/974)
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/tuf | <0.12.2 | 0.12.2 |
| Linuxfoundation The Update Framework | <=0.12.1 | |
| <=0.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/theupdateframework/tuf/pull/974
- https://github.com/theupdateframework/tuf/security/advisories/GHSA-pwqf-9h7j-7mv8
- https://nvd.nist.gov/vuln/detail/CVE-2020-6174
- https://github.com/theupdateframework/python-tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e
- https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2020-147.yaml
- https://github.com/theupdateframework/tuf/releases/tag/v0.12.2
- https://github.com/advisories/GHSA-pwqf-9h7j-7mv8 (Advisory)
Frequently Asked Questions
What is CVE-2020-6174?
CVE-2020-6174 is a vulnerability in the Metadadata signature verification in tuf.client.updater.
What is the impact of CVE-2020-6174?
The impact of CVE-2020-6174 is that an attacker with access to a valid signing key could create multiple valid signatures to meet the threshold for verification.
What is the severity of CVE-2020-6174?
The severity of CVE-2020-6174 is critical with a CVSS score of 9.8.
How can I fix CVE-2020-6174?
To fix CVE-2020-6174, update to version 0.12.2 of the tuf package using pip.
Where can I find more information about CVE-2020-6174?
For more information about CVE-2020-6174, you can refer to the following sources: [GitHub Advisory](https://github.com/theupdateframework/tuf/security/advisories/GHSA-pwqf-9h7j-7mv8) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-6174).
- collector/nvd-index
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/severity
- agent/first-publish-date
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pwqf-9h7j-7mv8
- alias/CVE-2020-6174
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/references
- agent/tags
- agent/trending
- vendor/linuxfoundation
- canonical/linuxfoundation the update framework
- version/linuxfoundation the update framework/0.12.1
- package-manager/pip