Tough Rollback Vulnerability in Delegated Targets Metadata

A vulnerability exists in Tough versions prior to 0.20.0, where the client fails to properly detect rollbacks in delegated targets during a target update process. This oversight can lead the client to retrieve targets from incorrect sources, potentially altering the contents of those targets. The issue arises because, while Tough checks for updates in regular targets metadata, it does not apply the same scrutiny to delegated targets. As a result, Tough may inadvertently trust and download outdated targets that should have been rejected.

Impact

This vulnerability could cause Tough to download and trust outdated delegated targets metadata, leading to the use of incorrect or modified target contents.

Remediation

Users are advised to upgrade to Tough version 0.20.0 or later and to patch any forked or derivative code to include the latest fixes.