CVE-2026-6966
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
वीकनेस
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
प्रभावित प्रोडक्ट
- amazon tough
- amazon tuftool
संदर्भ
- https://aws.amazon.com/security/security-bulletins/2026-019-aws/
- https://crates.io/crates/tough/0.22.0
- https://crates.io/crates/tuftool/0.15.0
- https://github.com/awslabs/tough/releases/tag/tough-v0.22.0
- https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0
- https://github.com/awslabs/tough/security/advisories/GHSA-8m7c-8m39-rv4x
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।