Linuxfoundation The Update Framework vulnerabilities

4 CVEs affecting Linuxfoundation The Update Framework, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-41131, published 2021-10-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-6173, published 2020-01-14. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
CVE-2021-41131, published 2021-10-19. High severity, CVSS 8.7. EPSS: 1.5% chance of exploitation in the next 30 days. python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can…
CVE-2020-6174, published 2020-02-05. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
CVE-2020-15163, published 2020-09-09. High severity, CVSS 8.2. EPSS: 0.7% chance of exploitation in the next 30 days. Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This…