本页列出影响 linuxfoundation the_update_framework 的已公开 CVE 漏洞（通过 NVD CPE 关联）。每行包含严重程度评分、摘要与发布日期，便于识别与分析安全问题。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2021-41131 | python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementatio | [email protected] | 7.5 | 1.40% | 2021-10-19 | 2024-11-21 |
| CVE-2020-15163 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer. | [email protected] | 8.7 | 0.55% | 2020-09-09 | 2024-11-21 |
| CVE-2020-6174 | TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. | [email protected] | 9.8 | 0.95% | 2020-02-05 | 2024-11-21 |
| CVE-2020-6173 | TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. | [email protected] | 5.3 | 1.40% | 2020-01-14 | 2024-11-21 |