| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| tuf | ≥ 0.14.0, < 0.16.0 | 0.16.0 |
The function _verify_root_self_signed(), introduced in v0.14.0, and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the threshold for new key self-signatures required during root metadata update.
A scenario where this attack could be relevant is amazingly unlikely in practice to the point where labeling this issue as a security advisory is potentially overstating the impact of the issue. Given that new root keys only become trusted by the client after a successful root metadata update, which also requires the quorum of signatures from old trusted root keys, this issue has been evaluated as low in severity.
In particular, in order to exploit this vulnerability, an attacker must:
A fix is available since version 0.16.0.
No workarounds are known for this issue.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン