CVE-2020-15163: Tuf Invalid Root May Become Trusted Vulnerability
MODERATECVE-2020-15163 is a MODERATE (CVSS 8.7) invalid root may become trusted vulnerability (CWE-345: Insufficient Verification of Data Authenticity) affecting Tuf libraries in the PyPI ecosystem. The issue involves invalid root may become trusted root in the update framework (tuf). Remediation is available by upgrading affected packages to version 0.12.0.
CVE-2020-15163 at a Glance
Security Impact
CVSS: 8.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
How to Fix CVE-2020-15163
To remediate this vulnerability, upgrade all affected Tuf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install tuf>=0.12.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show tufHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2020-15163, inspect your installed packages using pip:
pip show tufAnalyze the terminal output to locate any version of Tuf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.12.0), your application is affected.
Note: The pip show tuf command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-345: Insufficient Verification of Data Authenticity, where the product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. In Tuf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2020-15163 Affected Tuf Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
tuf
|
PyPI |
< 0.12.0
|
0.12.0
|
References
Frequently Asked Questions
What is CVE-2020-15163?
Which Tuf versions are affected?
What version fixes CVE-2020-15163?
Is tuf affected?
What is the CVSS score of CVE-2020-15163?
What CWE is associated with CVE-2020-15163?
How can I check PyPI dependencies for CVE-2020-15163?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-f8mr-jv2c-v8mg",
"modified" : "2024-11-18T22:41:33Z",
"published" : "2020-09-09T17:29:27Z",
"aliases" : [ "CVE-2020-15163" ],
"summary" : "Invalid root may become trusted root in The Update Framework (TUF)",
"details" : "### Impact\nThe Python TUF reference implementation `tuf<0.12` will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a man-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates.\n\nWhile investigating the reported vulnerability, we discovered that the detailed client workflow was not fully implemented. Specifically, for step 1.3 the newly downloaded root metadata was not being verified with a threshold of keys specified in the new root metadata file.\nThis missing step of the client workflow has been implemented in [PR #1101](https://github.com/theupdateframework/tuf/pull/1101), which is included in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0) of tuf.\n\n### Patches\nA [fix](https://github.com/theupdateframework/tuf/pull/885), is available in version [0.12](https://github.com/theupdateframework/tuf/releases/tag/v0.12.0) and newer.\n\n### Workarounds\nNo workarounds are known for this issue.\n\n### References\n* Pull request resolving the invalid root becoming trusted issue [PR 885](https://github.com/theupdateframework/tuf/pull/885)\n* Pull request implementing self verification of newly downloaded root metadata [PR 1101](https://github.com/theupdateframework/tuf/pull/1101)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "tuf"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.12.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-15163"
}, {
"type" : "WEB",
"url" : "https://github.com/theupdateframework/tuf/pull/885"
}, {
"type" : "WEB",
"url" : "https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2020-145.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/theupdateframework/tuf"
}, {
"type" : "WEB",
"url" : "https://github.com/theupdateframework/tuf/releases/tag/v0.12.0"
}, {
"type" : "WEB",
"url" : "https://pypi.org/project/tuf"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-345", "CWE-863" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2020-09-09T17:27:31Z",
"nvd_published_at" : "2020-09-09T18:15:00Z"
}
}