Vulnerabilities for tuf

First version without a known vulnerability: 7.0.0

Details

• GHSA-qp9x-wp8f-qgjj2026-05-28

  tuf has platform-dependent delegation path matching

  Fixed in: 7.0.0

• GHSA-77hh-43cm-v8j62024-02-16

  tuf's Metadata API: Targets.get_delegated_role() is missing input validation

  Fixed in: 3.1.1

• GHSA-r7vq-6425-j94w2022-09-15

  Python-TUF vulnerable to incorrect threshold signature computation for new root metadata

  Fixed in: 0.16.0

• GHSA-wjw6-2cqr-j4qr2021-10-19

  Client metadata path-traversal

  Fixed in: 0.19.0, 4ad7ae48fda594b640139c3b7eae21ed5155a102

• GHSA-f8mr-jv2c-v8mg2020-09-09

  Invalid root may become trusted root in The Update Framework (TUF)

  Fixed in: 0.12.0, 3d342e648fbacdf43a13d7ba8886aaaf07334af7

• GHSA-2828-9vh6-9m6j2020-08-21

  Client Denial of Service on TUF

  Fixed in: 0.12.2

• GHSA-pwqf-9h7j-7mv82020-08-21

  Incorrect threshold signature computation in TUF

  Fixed in: 0.12.2