https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:50:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-31499 EUVD-2026-31499 https://cve.radiocsirt.org/vuln/euvd-2026-31499 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41150 <p>Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.</p> <p>Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-41150 https://cve.radiocsirt.org/vuln/ghsa-r56q-vv3c-6g9c <p><strong>Affected:</strong> crates.io: tough</p> <p>### Impact The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system.</p> <p>AWS would like to thank https://github.com/jku for reporting this issue.</p> <p>### Patches A fix is available in version 0.12.0.</p> <p>### Workarounds No workarounds to this issue are known.</p> <p>### References https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr</p> <p><strong>Affected:</strong> crates.io: tough</p> <p>### Impact The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system.</p> <p>AWS would like to thank https://github.com/jku for reporting this issue.</p> <p>### Patches A fix is available in version 0.12.0.</p> <p>### Workarounds No workarounds to this issue are known.</p> <p>### References https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr</p> https://cve.radiocsirt.org/vuln/ghsa-r56q-vv3c-6g9c https://cve.radiocsirt.org/vuln/gsd-2021-41150 gsd-2021-41150 https://cve.radiocsirt.org/vuln/gsd-2021-41150