Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2021-41150

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 66.0%
CVSS Severity
CVSS v3 Score 8.2
CVSS v2 Score 3.5
Products affected by CVE-2021-41150
  • Amazon » Tough » Version: N/A
    cpe:2.3:a:amazon:tough:-
  • Amazon » Tough » Version: 0.1.0
    cpe:2.3:a:amazon:tough:0.1.0
  • Amazon » Tough » Version: 0.10.0
    cpe:2.3:a:amazon:tough:0.10.0
  • Amazon » Tough » Version: 0.11.0
    cpe:2.3:a:amazon:tough:0.11.0
  • Amazon » Tough » Version: 0.11.1
    cpe:2.3:a:amazon:tough:0.11.1
  • Amazon » Tough » Version: 0.11.2
    cpe:2.3:a:amazon:tough:0.11.2
  • Amazon » Tough » Version: 0.11.3
    cpe:2.3:a:amazon:tough:0.11.3
  • Amazon » Tough » Version: 0.2.0
    cpe:2.3:a:amazon:tough:0.2.0
  • Amazon » Tough » Version: 0.3.0
    cpe:2.3:a:amazon:tough:0.3.0
  • Amazon » Tough » Version: 0.4.0
    cpe:2.3:a:amazon:tough:0.4.0
  • Amazon » Tough » Version: 0.5.0
    cpe:2.3:a:amazon:tough:0.5.0
  • Amazon » Tough » Version: 0.6.0
    cpe:2.3:a:amazon:tough:0.6.0
  • Amazon » Tough » Version: 0.7.0
    cpe:2.3:a:amazon:tough:0.7.0
  • Amazon » Tough » Version: 0.7.1
    cpe:2.3:a:amazon:tough:0.7.1
  • Amazon » Tough » Version: 0.8.0
    cpe:2.3:a:amazon:tough:0.8.0
  • Amazon » Tough » Version: 0.9.0
    cpe:2.3:a:amazon:tough:0.9.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved