Patchfirst
Patchfirst
CVE-2020-15093 High · 8.6 EPSS 1.4%

Improper verification of signature threshold in tough

awslabs · tough

Official description · CVE.org

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.

Breakdown
20.3 / 100
Exploited
Not confirmed
Reports
0
Tactics
7/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

Disclosed on 9 Jul 2020. No public exploit code or confirmed exploitation is recorded.

2 related vulnerabilities in the same code over 5 months.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2020-6174TUF (aka The Update Framework) through 0.12.1 has Improper…5 Feb 2020
  2. relatedHigh

    Why these are linked:

    This CVECVE-2020-15093Improper verification of signature threshold in tough9 Jul 2020

techniques

4 , grouped by in kill-chain order 4

Initial AccessTA0001

Valid Accounts T1078 also Persistence, Privilege Escalation, Stealth
MITRE CTID mapping of the CVE · primary impact

Credential AccessTA0006

Network Sniffing T1040 also Discovery
MITRE CTID mapping of the CVE · primary impact
Brute Force T1110
MITRE CTID mapping of the CVE · how it is exploited
Adversary-in-the-Middle T1557 also Collection
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 100 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-15093 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Brute ForceT111025 general rules
All 25 on SigmaHQ ↗
Valid AccountsT107856 general rules
All 56 on SigmaHQ ↗
Network SniffingT10409 general rules
All 9 on SigmaHQ ↗
Adversary-in-the-MiddleT155710 general rules
All 10 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: tough.

CargotoughGHSA-5q2r-92f9-4m49RUSTSEC-2020-0024

Upgrade to 0.7.1 or later

Cargocargo update -p tough --precise 0.7.1

The first fix for CVE-2020-15093. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 0.7.10.7.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49

x_refsource_MISC 3

crates.io/crates/toughgithub.com/theupdateframework/tuf/pull/974github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e
↑ ↓ chooseEnter openEsc close