CVE-2026-6966

概要

参考情報

• aws.amazon.com/security/security-bulletins/2026-019-aws · Vendor Advisory
• crates.io/crates/tough/0.22.0 · Product
• crates.io/crates/tuftool/0.15.0 · Product
• awslabs/tough release tough-v0.22.0 · Release Notes
• awslabs/tough release tuftool-v0.15.0 · Release Notes
• awslabs/tough security advisory · Vendor Advisory

tough のその他の脆弱性

• CVE-2026-6968中 6.5Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to w…
• CVE-2026-6967中 6.5Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authen…
• CVE-2025-2888中 4.5During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform …
• CVE-2025-2887中 4.5During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from …
• CVE-2025-2886中 4.5Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a ter…