{"id":"EUVD-2021-1579","revision":"e8b573fc9077470a82a76dc398e93a98","records":[{"revision":"e8b573fc9077470a82a76dc398e93a98","observedAt":"2026-10-28T12:57:22.645+00:00","statement":{"source":"euvd","id":"EUVD-2021-1579","aliases":["CVE-2020-15093","GHSA-5q2r-92f9-4m49"],"title":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of u…","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","score":8.6,"severity":null}],"references":["https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49","https://crates.io/crates/tough","https://github.com/theupdateframework/tuf/pull/974","https://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1579","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 9, 2020, 6:45:16 PM","dateUpdated":"Aug 4, 2024, 1:08:21 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2021-1579","identifiers":["EUVD-2021-1579","CVE-2020-15093","GHSA-5q2r-92f9-4m49"]},"retained":false,"historicalAffected":[]}],"coverage":[]}