CVE-2020-15163

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-863 CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-1516410.0in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing,CVE-2020-151659.1Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious act CVE-2020-151667.5In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP e CVE-2020-151678.6In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause M CVE-2020-151685.3node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content CVE-2020-151696.1In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translatio CVE-2020-15177.8An elevation of privilege vulnerability exists when the Windows File Server Resource Management Service improperly handles memory. To exploi CVE-2020-151707.0apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not re CVE-2020-151716.6In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application serv CVE-2020-151728.8The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use s CVE-2020-151739.8In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which CVE-2020-151747.5In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpect