CVE-2020-15163

Python TUF < 0.12 Trusts Invalid Root Metadata

• CVSS 8.2
• CWE-345 Insufficient Verification of Data Authenticity
• Input Validation and Sanitization
• Remote

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

CVE

CVE-2020-15163

CWE

CWE-345 Insufficient Verification of Data Authenticity

CVSS base score

8.2

Published

2020-09-09

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to TUF version 0.12 or newer.

from tuf import repository_tool

def download_root_metadata(repository):
    root_metadata = repository.get_root()
    
    print("Root metadata downloaded and trusted without verification.")
    
    return root_metadata

from tuf import repository_tool
from tuf import exceptions

def download_root_metadata(repository):
    try:
        root_metadata = repository.get_root()
        
        repository.verify_root(root_metadata)
        
        print("Root metadata verified successfully.")
        
    except exceptions.MetadataError as e:
        print(f"Root metadata verification failed: {e}")
        raise

@misc{vaitp:cve202015163,
  title        = {{Python TUF < 0.12 Trusts Invalid Root Metadata}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-15163},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-15163/}}
}