CVE-2020-15093
Description
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.
References
CvssV3 impact
BaseSeverity | HIGH |
ConfidentialityImpact | NONE |
AttackComplexity | LOW |
Scope | CHANGED |
AttackVector | NETWORK |
AvailabilityImpact | NONE |
IntegrityImpact | HIGH |
PrivilegesRequired | NONE |
BaseScore | 8.6 |
VectorString | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Version | 3.1 |
UserInteraction | NONE |
CvssV2 impact
AccessComplexity | LOW |
ConfidentialityImpact | NONE |
AvailabilityImpact | NONE |
IntegrityImpact | PARTIAL |
BaseScore | 5 |
VectorString | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Version | 2.0 |
AccessVector | NETWORK |
Authentication | NONE |