CVE-2020-15093

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
awslabs	tough	< 0.7.1

References

https://crates.io/crates/toughThird Party Advisory
https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49Third Party Advisory
https://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0ePatch, Third Party Advisory
https://github.com/theupdateframework/tuf/pull/974Issue Tracking, Patch, Third Party Advisory
https://crates.io/crates/toughThird Party Advisory
https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49Third Party Advisory
https://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0ePatch, Third Party Advisory
https://github.com/theupdateframework/tuf/pull/974Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jul 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150948.8In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class CVE-2020-150954.4Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs lik CVE-2020-150966.8In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the mai CVE-2020-150979.1loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a CVE-2020-150988.8In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been disc CVE-2020-150998.1In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where CVE-2020-15105.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfull CVE-2020-151003.3In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been CVE-2020-151013.3In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion l CVE-2020-151026.5In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configurat CVE-2020-151033.5In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients a CVE-2020-151045.4In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS S