https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:42:18 +0000 https://cve.radiocsirt.org/vuln/cve-2020-6173 <p>TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.</p> <p>TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.</p> https://cve.radiocsirt.org/vuln/cve-2020-6173 https://cve.radiocsirt.org/vuln/ghsa-2828-9vh6-9m6j <p><strong>Affected:</strong> PyPI: tuf</p> <p>### Impact An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.</p> <p>The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.</p> <p>### Patches No fix exists for this issue.</p> <p>### Workarounds No workarounds are known for this issue.</p> <p>### References * [CVE-2020-6173](https://nvd.nist.gov/vuln/detail/CVE-2020-6173) * [Issue #973](https://github.com/theupdateframework/tuf/issues/973)</p> <p><strong>Affected:</strong> PyPI: tuf</p> <p>### Impact An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.</p> <p>The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.</p> <p>### Patches No fix exists for this issue.</p> <p>### Workarounds No workarounds are known for this issue.</p> <p>### References * [CVE-2020-6173](https://nvd.nist.gov/vuln/detail/CVE-2020-6173) * [Issue #973](https://github.com/theupdateframework/tuf/issues/973)</p> https://cve.radiocsirt.org/vuln/ghsa-2828-9vh6-9m6j