本ページは linuxfoundation the_update_framework に影響する公開済み CVE（NVD の CPE 経由で関連付け）を列挙します。各行に深刻度指標・概要・公開日が含まれます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2021-41131 | python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementatio | [email protected] | 7.5 | 1.40% | 2021-10-19 | 2026-06-17 |
| CVE-2020-15163 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer. | [email protected] | 8.7 | 0.55% | 2020-09-09 | 2026-06-16 |
| CVE-2020-6174 | TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. | [email protected] | 9.8 | 0.95% | 2020-02-05 | 2026-06-16 |
| CVE-2020-6173 | TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. | [email protected] | 5.3 | 1.40% | 2020-01-14 | 2026-06-16 |