CVE-2020-15093 Improper verification of signature threshold in tough
An attacker can bypass TUF signature threshold verification by duplicating valid signatures, allowing unauthorized metadata acceptance in the tough library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15093?
CVE-2020-15093 is a high-severity vulnerability in awslabs tough, published on 9 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.
Weakness: CWE-347
Which versions are affected by CVE-2020-15093?
3 open source packages ship an affected version, including tough. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tough crates.io | All versions | 0.7.1 |
tough crates.io | All versions | 0.7.1 |
tough crates.io | From 0.0.0-0 | 0.7.1 |
Products include Amazon Tough.
How do I fix CVE-2020-15093?
Upgrade tough to 0.7.1 or later.
Is CVE-2020-15093 being exploited?
There is no known exploitation of CVE-2020-15093 in the wild and no public exploit code.
Other vulnerabilities in awslabs tough
- CVE-2021-41149 Improper sanitization of target names in tough
- CVE-2021-41150 Improper sanitization of delegated role names in tough
- CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough
- CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough
- CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles
Sources
Also known as GHSA-5q2r-92f9-4m49, RUSTSEC-2020-0024.