GHSA-r7vq-6425-j94w: Tuf Python-TUF Vulnerable To Incorrect Threshold Vulnerability

LOW
Share
Published
Advisory Summary

GHSA-r7vq-6425-j94w is a LOW python-tuf vulnerable to incorrect threshold vulnerability (General Security Weakness) affecting Tuf libraries in the PyPI ecosystem. The issue involves python-tuf vulnerable to incorrect threshold signature computation for new root metadata. Remediation is available by upgrading affected packages to version 0.16.0.

GHSA-r7vq-6425-j94w at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-r7vq-6425-j94w
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Tuf
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix GHSA-r7vq-6425-j94w

To remediate this vulnerability, upgrade all affected Tuf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

tuf fixed: 0.16.0 
pip install tuf>=0.16.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show tuf

How to Check if You Are Affected

To determine whether your Python environment is affected by GHSA-r7vq-6425-j94w, inspect your installed packages using pip:

pip show tuf

Analyze the terminal output to locate any version of Tuf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.16.0), your application is affected.

Note: The pip show tuf command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Tuf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The function `_verify_root_self_signed()`, introduced in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0), and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the threshold for new key self-signatures required during root metadata update. A scenario where this attack could be relevant is amazingly unlikely in practice to the point where labeling this issue as a security advisory is potentially overstating the impact of the issue. Given that new root keys only become trusted by the client after a successful root metadata update, which also requires the quorum of signatures from old trusted root keys, this issue has been evaluated as low in severity. In particular, in order to exploit this vulnerability, an attacker must: 1. Control one new root key. 2. Craft a new root metadata file such that there is a number of signatures by this new root key greater than or equal to the new threshold. 3. Cause a valid threshold of the old root keys to sign this new root metadata file. 4. Cause this new root metadata file to be published on the repository. 5. Cause clients to rotate to this new root metadata file. ### Patches A [fix](https://github.com/theupdateframework/tuf/commit/83ac7be525b733f79a7e9bc573ec580ec835f179) is available since [version 0.16.0](https://github.com/theupdateframework/tuf/releases/tag/v0.16.0). ### Workarounds No workarounds are known for this issue. ### References * Pull request resolving the issue [PR 1218](https://github.com/theupdateframework/tuf/pull/1218) * Pull request which introduced the faulty computation of signature threshold on new root metadata [PR 1101](https://github.com/theupdateframework/tuf/pull/1101) * A similar previous issue with incorrectly computed signature thresholds in tuf is described in [GHSA-pwqf-9h7j-7mv8](https://github.com/theupdateframework/tuf/security/advisories/GHSA-pwqf-9h7j-7mv8)

GHSA-r7vq-6425-j94w Affected Tuf Versions

1 component(s)
Fixed Versions:
0.16.0
Product / Package Ecosystem Affected Versions Fixed Version
tuf
pypi/tuf
PyPI
≥ 0.14.0
< 0.16.0
0.16.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-pwqf-9h7j-7mv8
GitHub Advisory / Wiki ADVISORY
https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-r7vq-6425-j94w
Tuf Source Repository REPOSITORY
https://github.com/theupdateframework/python-tuf/pull/1218
Tuf Source Repository REPOSITORY
https://github.com/theupdateframework/tuf/pull/1101
Tuf Source Repository REPOSITORY
https://github.com/theupdateframework/python-tuf

Frequently Asked Questions

What is GHSA-r7vq-6425-j94w?
GHSA-r7vq-6425-j94w is a security vulnerability in Tuf involving Python-TUF vulnerable to incorrect threshold signature computation for new root metadata under General Security Weakness.
Which Tuf versions are affected?
Affected versions include releases prior to 0.16.0 across affected packages: tuf.
What version fixes GHSA-r7vq-6425-j94w?
Upgrading to 0.16.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is tuf affected?
Yes, tuf is affected in releases prior to 0.16.0. Upgrade your dependency to 0.16.0 or later.
What CWE is associated with GHSA-r7vq-6425-j94w?
GHSA-r7vq-6425-j94w is classified under General Security Weakness.
How can I check PyPI dependencies for GHSA-r7vq-6425-j94w?
Run the dependency tree command: 'pip show tuf'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r7vq-6425-j94w",
  "modified" : "2022-09-15T03:35:12Z",
  "published" : "2022-09-15T03:35:12Z",
  "aliases" : [ ],
  "summary" : "Python-TUF vulnerable to incorrect threshold signature computation for new root metadata",
  "details" : "### Impact\n\nThe function `_verify_root_self_signed()`, introduced in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0), and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the threshold for new key self-signatures required during root metadata update.\n\nA scenario where this attack could be relevant is amazingly unlikely in practice to the point where labeling this issue as a security advisory is potentially overstating the impact of the issue. Given that new root keys only become trusted by the client after a successful root metadata update, which also requires the quorum of signatures from old trusted root keys, this issue has been evaluated as low in severity.\n\nIn particular, in order to exploit this vulnerability, an attacker must:\n\n1. Control one new root key.\n2. Craft a new root metadata file such that there is a number of signatures by this new root key greater than or equal to the new threshold.\n3. Cause a valid threshold of the old root keys to sign this new root metadata file.\n4. Cause this new root metadata file to be published on the repository.\n5. Cause clients to rotate to this new root metadata file.\n\n### Patches\nA [fix](https://github.com/theupdateframework/tuf/commit/83ac7be525b733f79a7e9bc573ec580ec835f179) is available since [version 0.16.0](https://github.com/theupdateframework/tuf/releases/tag/v0.16.0).\n\n### Workarounds\nNo workarounds are known for this issue.\n\n### References\n* Pull request resolving the issue [PR 1218](https://github.com/theupdateframework/tuf/pull/1218)\n* Pull request which introduced the faulty computation of signature threshold on new root metadata [PR 1101](https://github.com/theupdateframework/tuf/pull/1101)\n* A similar previous issue with incorrectly computed signature thresholds in tuf is described in [GHSA-pwqf-9h7j-7mv8](https://github.com/theupdateframework/tuf/security/advisories/GHSA-pwqf-9h7j-7mv8)",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "tuf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.14.0"
      }, {
        "fixed" : "0.16.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.15.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-pwqf-9h7j-7mv8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-r7vq-6425-j94w"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/theupdateframework/python-tuf/pull/1218"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/theupdateframework/tuf/pull/1101"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/theupdateframework/python-tuf"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-09-15T03:35:12Z",
    "nvd_published_at" : null
  }
}