{"id":"EUVD-2021-1579","enisaUuid":"bbfa297c-d04c-3111-963f-5c3a9d42badf","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","datePublished":"Jul 9, 2020, 6:45:16 PM","dateUpdated":"Aug 4, 2024, 1:08:21 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","references":"https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49\nhttps://crates.io/crates/tough\nhttps://github.com/theupdateframework/tuf/pull/974\nhttps://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e\n","aliases":"CVE-2020-15093\nGHSA-5q2r-92f9-4m49\n","assigner":"GitHub_M","epss":1.36,"enisaIdProduct":[{"id":"3fb042ca-c4eb-304c-bd59-2fb029277119","product":{"name":"tough","vendor":{"name":"aws"}},"product_version":"\u003c 0.7.1"}],"enisaIdVendor":[{"id":"fe930f45-1abb-3df8-9083-68bb53edd260","vendor":{"name":"awslabs"}}],"enisaIdVulnerability":[{"id":"0d68bc6d-5c3e-358f-9f0d-587dbc11e906","vulnerability":{"id":"CVE-2020-15093","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","datePublished":"Jul 9, 2020, 6:45:16 PM","dateUpdated":"Aug 4, 2024, 1:08:21 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","references":"https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49\nhttps://crates.io/crates/tough\nhttps://github.com/theupdateframework/tuf/pull/974\nhttps://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e\n","enisa_id":"EUVD-2021-1579\n","assigner":"GitHub_M","epss":1.36,"dataProcessed":"Nov 7, 2026, 7:22:23 AM","vulnerabilityProduct":[{"id":"8cd35946-6f3d-3174-a186-c0533c424822","product":{"name":"tough","vendor":{"name":"aws"}},"product_version":"\u003c 0.7.1"}],"vulnerabilityVendor":[{"id":"4305575c-44e1-36a1-896c-45685c894e35","vendor":{"name":"awslabs"}}]}},{"id":"7cfb5589-2fff-392b-8c52-74b4619dfee1","vulnerability":{"id":"GHSA-5q2r-92f9-4m49","description":"Improper verification of signature threshold in tough","datePublished":"Aug 25, 2021, 8:56:55 PM","dateUpdated":"Oct 27, 2021, 5:03:38 PM","baseScore":null,"references":"https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15093\nhttps://github.com/theupdateframework/tuf/pull/974\nhttps://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e\nhttps://github.com/awslabs/tough\nhttps://rustsec.org/advisories/RUSTSEC-2020-0024.html\n","enisa_id":"EUVD-2021-1579\n","aliases":"GHSA-5q2r-92f9-4m49\nCVE-2020-15093\n","epss":0.0,"dataProcessed":"Apr 26, 2026, 1:42:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}