{"id":"RUSTSEC-2020-0024","revision":"85221f4614ce4d93b47c4379ebb33770","records":[{"revision":"85221f4614ce4d93b47c4379ebb33770","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2020-0024","aliases":["CVE-2020-15093","GHSA-5q2r-92f9-4m49"],"title":"Improper uniqueness verification of signature threshold","description":"The tough library, prior to 0.7.1, does not properly verify the uniqueness of\nkeys in the signatures provided to meet the threshold of cryptographic\nsignatures. It allows someone with access to a valid signing key to create\nmultiple valid signatures in order to circumvent TUF requiring a minimum\nthreshold of unique keys before the metadata is considered valid.\n\nAWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for\nreporting this issue.\n\nA fix is available in version 0.7.1.\n\nCVE-2020-6174 is assigned to the same issue in the TUF reference\nimplementation.\n\nIf you have any questions or comments about this advisory, contact AWS Security\nat aws-security@amazon.com.","state":0,"publishedAt":"2020-07-09T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:05.1255262+00:00","affected":[{"ecosystem":"crates.io","name":"tough","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/tough","https://rustsec.org/advisories/RUSTSEC-2020-0024.html","https://github.com/awslabs/tough/commit/c1c950682d765ebc661f70381f947bc28b8b058c"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2020-0024","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2020-0024","identifiers":["RUSTSEC-2020-0024","CVE-2020-15093","GHSA-5q2r-92f9-4m49"]},"retained":false,"historicalAffected":[]}],"coverage":[]}