Amazon Tough
10 CVEs affecting Amazon Tough. Latest disclosed: 2026-04-24. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15093 | High | 8.6 | 2020-07-09 | The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicat… |
CVE-2021-41150 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-41149 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2026-6968 | Medium | 5.9 | 2026-04-24 | Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside… |
CVE-2026-6967 | Medium | 5.9 | 2026-04-24 | Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with… |
CVE-2026-6966 | Medium | 5.3 | 2026-04-24 | Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated user… |
CVE-2025-2888 | Medium | 4.5 | 2025-03-27 | During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, th… |
CVE-2025-2887 | Medium | 4.5 | 2025-03-27 | During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source… |
CVE-2025-2886 | Medium | 4.5 | 2025-03-27 | Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation… |
CVE-2025-2885 | Medium | 4.5 | 2025-03-27 | Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended versio… |