{"id":"CVE-2020-15093","aliases":["EUVD-2021-1579","GHSA-5q2r-92f9-4m49","RUSTSEC-2020-0024"],"status":"published","title":"Improper verification of signature threshold in tough","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01357,"percentile":0.71865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2020-07-09T12:00:00Z","modified":"2026-11-07T02:45:04Z","fixes":[{"ecosystem":"crates.io","package":"tough","fixed_in":["0.7.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"tough","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"tough","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"tough","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.1"}]}]}],"products":[{"vendor":"amazon","product":"tough"},{"vendor":"aws","product":"tough"},{"vendor":"awslabs","product":"tough"}],"references":[{"url":"https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://crates.io/crates/tough","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","package"]},{"url":"https://github.com/theupdateframework/tuf/pull/974","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15093","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0024.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5q2r-92f9-4m49"},{"url":"https://github.com/awslabs/tough","tags":["package"]},{"url":"https://github.com/awslabs/tough/commit/c1c950682d765ebc661f70381f947bc28b8b058c","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15093","title":"Improper verification of signature threshold in tough","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","status":"published","published":"2020-07-09T18:45:16Z","modified":"2024-08-04T13:08:21.663Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2021-1579","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","status":"published","published":"2020-07-09T18:45:16Z","modified":"2024-08-04T13:08:21Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:33.100327Z"}],"ghsa":[{"id":"GHSA-5q2r-92f9-4m49","title":"Improper verification of signature threshold in tough","description":"## Impact\n\nThe tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a minimum threshold of unique keys before the metadata is considered valid.\n\nAWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for reporting this issue. \n\n## Patches\n\nA fix is available in version 0.7.1.\n\n## Workarounds\n\nNo workarounds to this issue are known.\n\n## References\n\nCVE-2020-6174 is assigned to the same issue in the TUF reference implementation.\n\nhttps://github.com/theupdateframework/tuf/pull/974\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-6174\n\n## For more information\n\nIf you have any questions or comments about this advisory, [contact AWS Security](https://aws.amazon.com/security/vulnerability-reporting/) at [aws-security@amazon.com](mailto:aws-security@amazon.com).","status":"published","published":"2021-08-25T20:56:55Z","modified":"2023-02-03T05:05:56Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:43.439065Z"}],"nvd":[{"id":"CVE-2020-15093","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","status":"published","published":"2020-07-09T19:15:11.413Z","modified":"2026-06-17T02:56:02.333Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:06:09.126752Z"}],"osv":[{"id":"CVE-2020-15093","description":"The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.","status":"published","published":"2020-07-09T19:15:11.413Z","modified":"2026-11-07T02:45:04.289854121Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-07T03:07:44.766156Z"},{"id":"GHSA-5q2r-92f9-4m49","title":"Improper verification of signature threshold in tough","description":"## Impact\n\nThe tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a minimum threshold of unique keys before the metadata is considered valid.\n\nAWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for reporting this issue. \n\n## Patches\n\nA fix is available in version 0.7.1.\n\n## Workarounds\n\nNo workarounds to this issue are known.\n\n## References\n\nCVE-2020-6174 is assigned to the same issue in the TUF reference implementation.\n\nhttps://github.com/theupdateframework/tuf/pull/974\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-6174\n\n## For more information\n\nIf you have any questions or comments about this advisory, [contact AWS Security](https://aws.amazon.com/security/vulnerability-reporting/) at [aws-security@amazon.com](mailto:aws-security@amazon.com).","status":"published","published":"2021-08-25T20:56:55Z","modified":"2026-07-08T06:29:16.8755628Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"RUSTSEC-2020-0024","title":"Improper uniqueness verification of signature threshold","description":"The tough library, prior to 0.7.1, does not properly verify the uniqueness of\nkeys in the signatures provided to meet the threshold of cryptographic\nsignatures. It allows someone with access to a valid signing key to create\nmultiple valid signatures in order to circumvent TUF requiring a minimum\nthreshold of unique keys before the metadata is considered valid.\n\nAWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for\nreporting this issue.\n\nA fix is available in version 0.7.1.\n\nCVE-2020-6174 is assigned to the same issue in the TUF reference\nimplementation.\n\nIf you have any questions or comments about this advisory, contact AWS Security\nat aws-security@amazon.com.","status":"published","published":"2020-07-09T12:00:00Z","modified":"2026-10-12T18:00:05.125526245Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}