CVE-2020-15163: linuxfoundation the_update_framework Incorrect Authorization

Vulnerability summary

CVE-2020-15163 is a high (CVSS 8.7) Incorrect Authorization vulnerability in linuxfoundation the_update_framework. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51% of scored vulnerabilities.

Timeline

1. 09-09-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.