Threats affecting pkg:cargo/awslabs/tuftool

A vulnerability in the awslabs/tough library prior to version 0.22.0 allows remote authenticated users with delegated signing authority to bypass integrity checks on delegated targets metadata. This occurs because delegated metadata validation lacks expiration, hash, and length enforcement, enabling poisoning of the local metadata cache. The issue affects tough versions 0.9.0 through 0.21.x and tuftool versions before 0.15.0. The flaw has been fixed in tough 0.22.0 and tuftool 0.15.0. No workarounds are known.

A vulnerability in the awslabs/tough library before version 0.22.0 allows remote authenticated users to bypass the TUF delegated role signature threshold by duplicating a valid signature. This flaw permits acceptance of forged delegated role metadata due to improper verification of signature uniqueness. The issue is fixed in tough 0.22.0 and tuftool 0.15.0. No known workarounds exist.

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.