Tough (Amazon) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 42 known versions, newest CVE from 2026-04-24. Vendor: Amazon.
CVEs of Tough
- CVE-2026-6968 - CVSS 7.1 (high), 2026-04-24: Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside…
- CVE-2026-6967 - CVSS 7.1 (high), 2026-04-24: Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with…
- CVE-2026-6966 - CVSS 7 (high), 2026-04-24: Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated…
- CVE-2025-2885 - CVSS 5.7 (medium), 2025-03-27: Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended…
- CVE-2025-2888 - CVSS 5.7 (medium), 2025-03-27: During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update,…
- CVE-2025-2887 - CVSS 5.7 (medium), 2025-03-27: During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect…
- CVE-2025-2886 - CVSS 5.7 (medium), 2025-03-27: Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating…
- CVE-2021-41150 - CVSS 8.2 (high), 2021-10-19: Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does…
- CVE-2021-41149 - CVSS 8.2 (high), 2021-10-19: Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does…
- CVE-2020-15093 - CVSS 8.6 (high), 2020-07-09: The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to…
