Tough Timestamp Metadata Caching Vulnerability During Snapshot Rollback

A vulnerability exists in the Tough library, specifically in versions prior to 0.20.0, related to the incorrect caching of timestamp metadata during snapshot rollback events. This issue can cause the client to improperly validate update timestamps, leading to a failure in processing valid updates until the cache is manually cleared. The vulnerability arises because Tough, while it can detect rollbacks, still retains outdated timestamp metadata as trusted, which can disrupt the update process.

Impact

Exploitation of this vulnerability can cause the Tough client to incorrectly reject valid timestamp metadata updates, disrupting the update process and potentially leaving the system vulnerable or outdated.

Remediation

Users are advised to upgrade to Tough version 0.20.0 or later and to patch any forked or derivative code to include the latest fixes.