Invalid root may become trusted root in The Update Framework (TUF)
Impact
The Python TUF reference implementation tuf<0.12 will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a man-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates.
While investigating the reported vulnerability, we discovered that the detailed client workflow was not fully implemented. Specifically, for step 1.3 the newly downloaded root metadata was not being verified with a threshold of keys specified in the new root metadata file. This missing step of the client workflow has been implemented in PR #1101, which is included in v0.14.0 of tuf.
Patches
A fix, is available in version 0.12 and newer.
Workarounds
No workarounds are known for this issue.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | tuf | < 0.12.0 | 0.12.0 |
References
- https://github.com/theupdateframework/tuf/releases/tag/v0.12.0
- https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg
- https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7
- https://pypi.org/project/tuf
- https://github.com/theupdateframework/tuf/pull/885
- https://nvd.nist.gov/vuln/detail/CVE-2020-15163
- https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2020-145.yaml
- https://github.com/theupdateframework/tuf
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-345, CWE-863- Platform
- Python (PyPI)
- Package
tuf- Disclosed
- 09.09.2020
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2020-145 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-f8mr-jv2c-v8mg - CC BY 4.0
Vulnerability history: tuf
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 01.2020 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Medium 4
- Low 2
Disclosures per year
- 2020: 3
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 1
-
Invalid root may become trusted root in The Update Framework (TUF) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.