awslabs Tough Library and Tuftool CLI Utility Signature Bypass Vulnerability

A vulnerability in the awslabs Tough library and its command-line utility, Tuftool, prior to versions 0.22.0 and 0.15.0 respectively, allows remote authenticated users to bypass the TUF signature threshold requirement. This is achieved by duplicating a valid cryptographic signature, which can then be used to forge delegated role metadata. The issue arises from improper verification of signature uniqueness in delegated role validation.

Impact

Exploitation of this vulnerability allows for the forgery of delegated role metadata, potentially leading to unauthorized changes in a TUF repository.

Remediation

Users are advised to upgrade to Tough version 0.22.0 or later and Tuftool version 0.15.0 or later. Instructions for upgrading are available in the Tough and Tuftool GitHub repositories.