GHSA-r56q-vv3c-6g9c

    Dashboard / Vulnerabilities / GHSA-r56q-vv3c-6g9c

    GHSA-r56q-vv3c-6g9c

    Published: 19 Oct 2021Last Modified: 4 Feb 2026

    Summary: Improper sanitization of delegated role names

    Details: ### Impact The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. AWS would like to thank https://github.com/jku for reporting this issue. ### Patches A fix is available in version 0.12.0. ### Workarounds No workarounds to this issue are known. ### References https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr

    References: https://github.com/awslabs/tough/security/advisories/GHSA-r56q-vv3c-6g9c, https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr, https://nvd.nist.gov/vuln/detail/CVE-2021-41150, https://github.com/awslabs/tough/commit/1809b9bd1106d78a51fbea3071aa97a3530bac9a, https://github.com/awslabs/tough

    Affected packages

    Package

    Name: tough

    Purl: pkg:cargo/tough

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.12.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-r56q-vv3c-6g9c | CVE-DB