GHSA-x3r5-q6mj-m485

    Dashboard / Vulnerabilities / GHSA-x3r5-q6mj-m485

    GHSA-x3r5-q6mj-m485

    Published: 19 Oct 2021Last Modified: 8 Jul 2026

    Summary: Improper sanitization of target names

    Details: ### Impact The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. AWS would like to thank https://github.com/jku for reporting this issue. ### Patches A fix is available in version 0.12.0. ### Workarounds No workarounds to this issue are known.

    References: https://github.com/awslabs/tough/security/advisories/GHSA-x3r5-q6mj-m485, https://nvd.nist.gov/vuln/detail/CVE-2021-41149, https://github.com/awslabs/tough/commit/1809b9bd1106d78a51fbea3071aa97a3530bac9a, https://github.com/awslabs/tough

    Affected packages

    Package

    Name: tough

    Purl: pkg:cargo/tough

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.12.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-x3r5-q6mj-m485 | CVE-DB