CVE-2021-41150: Improper sanitization of delegated role names in tough
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41150?
CVE-2021-41150 is a vulnerability in the Tough library prior to version 0.12.0 that allows untrusted role names to be cached or loaded from the filesystem, leading to potential security issues.
What is the severity of CVE-2021-41150?
The severity of CVE-2021-41150 is high, with a CVSS score of 6.5.
How does CVE-2021-41150 affect Amazon Tough?
CVE-2021-41150 affects Amazon Tough versions up to and excluding 0.12.0.
How can I fix CVE-2021-41150?
To fix CVE-2021-41150, update your Amazon Tough installation to version 0.12.0 or higher.
Where can I find more information about CVE-2021-41150?
You can find more information about CVE-2021-41150 on the GitHub page of the Tough library and the Python TUF library.