CVE-2020-6174: Incorrect threshold signature computation in TUF
Summary
CVE-2020-6174: Incorrect threshold signature computation in TUF. Affects tuf versions < 0.12.2. Fixed in 0.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TUF (The Update Framework) is an open-source software update security framework. It provides a secure method for distributing software updates to clients. TUF ensures the integrity and authenticity of software updates by using cryptographic signatures. The vulnerability identified as CVE-2020-6174 affects the TUF package.
Vulnerability Detail
The vulnerability in TUF arises from an incorrect threshold signature computation in the metadata signature verification process. The verification incorrectly counts each signature with identical authorized keyids separately towards the threshold. This means that an attacker with access to a valid signing key could create multiple valid signatures to meet the minimum threshold of keys required for the metadata to be considered valid. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.0.1 as of 23 Oct 2026
pip install --upgrade "tuf==7.0.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.2
This is the first release that contains the fix.
pip install --upgrade "tuf==0.12.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability. It is essential to update the TUF package to the fixed version.
Conclusion
The vulnerability in TUF (CVE-2020-6174) allows an attacker to bypass the threshold requirement for metadata signature verification. To mitigate this vulnerability, it is crucial to update the TUF package to version 0.12.2 or newer. No workarounds are available. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tuf →
FAQ
TUF (The Update Framework) is an open-source software update security framework that provides a secure method for distributing software updates to clients.
The vulnerability allows an attacker with access to a valid signing key to create multiple valid signatures, bypassing the threshold requirement for metadata signature verification.
Erik MacLean of Analog Devices, Inc. reported this vulnerability.
The CVE identifier for this vulnerability is CVE-2020-6174.
No, there are no known workarounds for this vulnerability. Updating to the fixed version is necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for tuf.
