VulnerableCode Package Details - pkg:pypi/tuf@0.11.2.dev1

Search for packages

Vulnerability	Summary	Fixed by
VCID-6tgx-mpvy-63ab Aliases: CVE-2020-6173 GHSA-2828-9vh6-9m6j PYSEC-2020-146	TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.	0.12.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-m2sw-ms1a-zkb5 Aliases: CVE-2020-15163 GHSA-f8mr-jv2c-v8mg PYSEC-2020-145	Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.	0.12.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-px54-yh8d-5bbc Aliases: CVE-2021-41131 GHSA-wjw6-2cqr-j4qr PYSEC-2021-376	python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.	0.19.0 Affected by 0 other vulnerabilities.
VCID-q9jt-smnw-s3h9 Aliases: CVE-2020-6174 GHSA-pwqf-9h7j-7mv8 PYSEC-2020-147	TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.	0.12.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-6tgx-mpvy-63ab
Aliases:
CVE-2020-6173
GHSA-2828-9vh6-9m6j
PYSEC-2020-146

TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

0.12.2
Affected by 1 other vulnerability.

VCID-m2sw-ms1a-zkb5
Aliases:
CVE-2020-15163
GHSA-f8mr-jv2c-v8mg
PYSEC-2020-145

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

0.12.0
Affected by 3 other vulnerabilities.

VCID-px54-yh8d-5bbc
Aliases:
CVE-2021-41131
GHSA-wjw6-2cqr-j4qr
PYSEC-2021-376

python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.

0.19.0
Affected by 0 other vulnerabilities.

VCID-q9jt-smnw-s3h9
Aliases:
CVE-2020-6174
GHSA-pwqf-9h7j-7mv8
PYSEC-2020-147

TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

0.12.2
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:14:48.907766+00:00	Pypa Importer	Affected by	VCID-px54-yh8d-5bbc	https://github.com/pypa/advisory-database/blob/main/vulns/tuf/PYSEC-2021-376.yaml	38.6.0
2026-06-02T04:06:57.643741+00:00	Pypa Importer	Affected by	VCID-m2sw-ms1a-zkb5	https://github.com/pypa/advisory-database/blob/main/vulns/tuf/PYSEC-2020-145.yaml	38.6.0
2026-06-02T04:06:10.716919+00:00	Pypa Importer	Affected by	VCID-q9jt-smnw-s3h9	https://github.com/pypa/advisory-database/blob/main/vulns/tuf/PYSEC-2020-147.yaml	38.6.0
2026-06-02T04:06:05.382662+00:00	Pypa Importer	Affected by	VCID-6tgx-mpvy-63ab	https://github.com/pypa/advisory-database/blob/main/vulns/tuf/PYSEC-2020-146.yaml	38.6.0