Skip to content
OpenAdvisories

Package · PyPI

tuf

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 4.0
    CVE-2026-123806

    tuf has platform-dependent delegation path matching

    python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path author…

    theupdateframework python-tuf datadog-agent-7.77-core-integrations datadog-agent-7.78-core-integrations Ubuntu Wolfi PyPI
  • Medium 4.0
    GHSA-qp9x-wp8f-qgjj

    tuf has platform-dependent delegation path matching

    `DelegatedRole._is_target_in_pathpattern` uses `fnmatch.fnmatch` to decide whether a given target path is authorized by a delegation's glob pattern. Python's `fnmatch.fnmatch` calls `os.path.normcase()` on both arguments before matching. On POSIX hosts `normc…

    tuf PyPI
  • Low —
    GHSA-77hh-43cm-v8j6

    tuf's Metadata API: Targets.get_delegated_role() is missing input validation

    The security of both a TUF client and repository implementations depend on the concept of trusted Metadata objects verifying the signatures over other Metadata that it delegates to. This verification process uses `Targets.get_delegated_role(delegated_role: st…

    tuf PyPI
  • Low —
    GHSA-r7vq-6425-j94w

    Python-TUF vulnerable to incorrect threshold signature computation for new root metadata

    ### Impact The function `_verify_root_self_signed()`, introduced in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0), and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towa…

    tuf PyPI
  • High 7.5
    CVE-2021-41131

    Client metadata path-traversal in python-tuf

    python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client syste…

    theupdateframework python-tuf tuf PyPI
  • High 8.7
    CVE-2020-15163

    Invalid root may become trusted root in The Update Framework (TUF)

    Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions …

    theupdateframework tuf tuf PyPI
  • Critical 9.8
    CVE-2020-6174

    Incorrect threshold signature computation in TUF

    TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

    tuf PyPI
  • Medium 5.3
    CVE-2020-6173

    Client Denial of Service on TUF

    TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.

    tuf PyPI