Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:pypi/tuf@0.7.5

Type pypi

Namespace

Name tuf

Version 0.7.5

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 0.19.0

Latest_non_vulnerable_version 3.1.1

Affected_by_vulnerabilities

url VCID-6tgx-mpvy-63ab

vulnerability_id VCID-6tgx-mpvy-63ab

summary TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

references

reference_url	https://github.com/advisories/GHSA-2828-9vh6-9m6j
reference_id
reference_type
scores
url	https://github.com/advisories/GHSA-2828-9vh6-9m6j

reference_url	https://github.com/theupdateframework/tuf/commits/develop
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/commits/develop

reference_url	https://github.com/theupdateframework/tuf/issues/973
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/issues/973

fixed_packages

url pkg:pypi/tuf@0.12.2

purl pkg:pypi/tuf@0.12.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-px54-yh8d-5bbc

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tuf@0.12.2

aliases CVE-2020-6173, GHSA-2828-9vh6-9m6j, PYSEC-2020-146

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6tgx-mpvy-63ab

url VCID-m2sw-ms1a-zkb5

vulnerability_id VCID-m2sw-ms1a-zkb5

summary Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

references

reference_url	https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7

reference_url	https://github.com/theupdateframework/tuf/pull/885
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/pull/885

reference_url	https://github.com/theupdateframework/tuf/releases/tag/v0.12.0
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/releases/tag/v0.12.0

reference_url	https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg

reference_url	https://pypi.org/project/tuf
reference_id
reference_type
scores
url	https://pypi.org/project/tuf

fixed_packages

url pkg:pypi/tuf@0.12.0

purl pkg:pypi/tuf@0.12.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6tgx-mpvy-63ab

vulnerability	VCID-px54-yh8d-5bbc

vulnerability	VCID-q9jt-smnw-s3h9

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tuf@0.12.0

aliases CVE-2020-15163, GHSA-f8mr-jv2c-v8mg, PYSEC-2020-145

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m2sw-ms1a-zkb5

url VCID-px54-yh8d-5bbc

vulnerability_id VCID-px54-yh8d-5bbc

summary python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.

references

reference_url	https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2021-376.yaml
reference_id
reference_type
scores
url	https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2021-376.yaml

reference_url	https://github.com/theupdateframework/python-tuf
reference_id
reference_type
scores
url	https://github.com/theupdateframework/python-tuf

reference_url	https://github.com/theupdateframework/python-tuf/commit/4ad7ae48fda594b640139c3b7eae21ed5155a102
reference_id
reference_type
scores
url	https://github.com/theupdateframework/python-tuf/commit/4ad7ae48fda594b640139c3b7eae21ed5155a102

reference_url	https://github.com/theupdateframework/python-tuf/issues/1527
reference_id
reference_type
scores
url	https://github.com/theupdateframework/python-tuf/issues/1527

reference_url	https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr
reference_id
reference_type
scores
url	https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2021-41131
reference_id	CVE-2021-41131
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2021-41131

reference_url	https://github.com/advisories/GHSA-wjw6-2cqr-j4qr
reference_id	GHSA-wjw6-2cqr-j4qr
reference_type
scores
url	https://github.com/advisories/GHSA-wjw6-2cqr-j4qr

fixed_packages

url	pkg:pypi/tuf@0.19.0
purl	pkg:pypi/tuf@0.19.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tuf@0.19.0

aliases CVE-2021-41131, GHSA-wjw6-2cqr-j4qr, PYSEC-2021-376

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-px54-yh8d-5bbc

url VCID-q9jt-smnw-s3h9

vulnerability_id VCID-q9jt-smnw-s3h9

summary TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

references

reference_url	https://github.com/advisories/GHSA-pwqf-9h7j-7mv8
reference_id
reference_type
scores
url	https://github.com/advisories/GHSA-pwqf-9h7j-7mv8

reference_url	https://github.com/theupdateframework/tuf/pull/974
reference_id
reference_type
scores
url	https://github.com/theupdateframework/tuf/pull/974

fixed_packages

url pkg:pypi/tuf@0.12.2

purl pkg:pypi/tuf@0.12.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-px54-yh8d-5bbc

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tuf@0.12.2

aliases CVE-2020-6174, GHSA-pwqf-9h7j-7mv8, PYSEC-2020-147

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-q9jt-smnw-s3h9

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tuf@0.7.5

Package Instance