Vulnerability HighRUSTSEC-2020-0024 · tough
RUSTSEC-2020-0024: Improper uniqueness verification of signature threshold
Short answerA security vulnerability in the tough crate: Improper uniqueness verification of signature threshold. High severity (CVSS 8.6). Fixed in 0.7.1: update to a fixed version.
| Crate | tough |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.7.1. |
| Fixed in | 0.7.1 |
| Severity | High, CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| Published | 2020-07-09 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2020-15093, GHSA-5q2r-92f9-4m49 |
What to do
- See which version you have:
cargo tree -i tough(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p tough. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampletough = "0.7.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a minimum threshold of unique keys before the metadata is considered valid.
AWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for reporting this issue.
A fix is available in version 0.7.1.
CVE-2020-6174 is assigned to the same issue in the TUF reference implementation.
If you have any questions or comments about this advisory, contact AWS Security at aws-security@amazon.com.
References
- Package: crates.io/crates/tough
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0024.html
- Web: github.com/awslabs/tough/commit/c1c950682d765ebc661f70381f947bc28b8b058c
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for tough
- VulnerabilityGHSA-4v58-8p28-2rq3 · 2026-05-05awslabs/tough is Missing Delegated Metadata Validation
- VulnerabilityGHSA-5vmp-m5v2-hx47 · 2025-03-28tough root metadata version is not checked for sequential versioning
- VulnerabilityGHSA-76g3-38jv-wxh4 · 2025-03-28tough timestamp metadata is cached when it fails snapshot rollback check
- VulnerabilityGHSA-8m7c-8m39-rv4x · 2026-05-05awslabs/tough Delegated Roles have a Signature Threshold Bypass
- VulnerabilityGHSA-j8x2-777p-23fc · 2025-03-28tough cyclic delegation graphs are not detected
- VulnerabilityGHSA-q6r9-r9pw-4cf7 · 2025-03-28tough failure to detect delegated target rollback
- VulnerabilityGHSA-r56q-vv3c-6g9c · 2021-10-19Improper sanitization of delegated role names
- VulnerabilityGHSA-v4wr-j3w6-mxqc · 2025-03-28tough terminating targets role delegations are not respected
Up next
Same cratetough: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?