What’s Vulnerable › Vulnerabilities

CVE-2020-15163: Invalid root may become trusted root in The Update Framework (TUF)

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-09 · updated 2026-06-17
• Weakness: CWE-863

Description

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

Affected products

• Linuxfoundation The Update Framework: before 0.12.0 — fixed in 0.12.0

How to fix

Upgrade to a fixed version: Linuxfoundation The Update Framework 0.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7
• https://github.com/theupdateframework/tuf/pull/885
• https://github.com/theupdateframework/tuf/releases/tag/v0.12.0
• https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg
• https://pypi.org/project/tuf
• https://github.com/theupdateframework/tuf/commit/3d342e648fbacdf43a13d7ba8886aaaf07334af7
• https://github.com/theupdateframework/tuf/pull/885
• https://github.com/theupdateframework/tuf/releases/tag/v0.12.0
• https://github.com/theupdateframework/tuf/security/advisories/GHSA-f8mr-jv2c-v8mg
• https://pypi.org/project/tuf

Get alerted when CVE-2020-15163 or the next vulnerability affects your stack