Description
python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| theupdateframework | python-tuf | < 7.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-tuf | No fix yet | — |
| Ubuntu 26.04 LTS | python-tuf | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | datadog-agent-7.72-core-integrations | No fix yet | — |
| Wolfi rolling | datadog-agent-7.73-core-integrations | 7.73.3-r23 | — |
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r12 | — |
| Wolfi rolling | datadog-agent-7.78-core-integrations | 7.78.4-r8 | — |
| Wolfi rolling | datadog-agent-7.79-core-integrations | 7.79.2-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tuf | < 7.0.0 | 7.0.0 | GHSA-qp9x-wp8f-qgjj |