{"id":"CVE-2020-15093","aliases":["RUSTSEC-2020-0024","GHSA-5q2r-92f9-4m49"],"title":"Improper uniqueness verification of signature threshold","summary":"Improper uniqueness verification of signature threshold","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","vendor":"tough","product":"tough","ecosystem":"rust","affected":["tough >= 0.0.0-0, < 0.7.1"],"patched":["tough 0.7.1"],"published":"2020-07-09","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:05.125526245Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2020-0024","references":[{"url":"https://crates.io/crates/tough"},{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0024.html"},{"url":"https://github.com/awslabs/tough/commit/c1c950682d765ebc661f70381f947bc28b8b058c"},{"url":"https://github.com/awslabs/tough/security/advisories/GHSA-5q2r-92f9-4m49"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15093"},{"url":"https://github.com/theupdateframework/tuf/pull/974"},{"url":"https://github.com/theupdateframework/tuf/commit/2977188139d065ff3356c3cb4aec60c582b57e0e"},{"url":"https://github.com/awslabs/tough"}],"tags":["osv","rust"],"epss":0.01357,"epssPercentile":0.71517,"ingestedAt":"2026-07-09T18:56:37.280Z","slug":"CVE-2020-15093","body":"## Overview\n\nThe tough library, prior to 0.7.1, does not properly verify the uniqueness of\nkeys in the signatures provided to meet the threshold of cryptographic\nsignatures. It allows someone with access to a valid signing key to create\nmultiple valid signatures in order to circumvent TUF requiring a minimum\nthreshold of unique keys before the metadata is considered valid.\n\nAWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for\nreporting this issue.\n\nA fix is available in version 0.7.1.\n\nCVE-2020-6174 is assigned to the same issue in the TUF reference\nimplementation.\n\nIf you have any questions or comments about this advisory, contact AWS Security\nat aws-security@amazon.com.\n\n## Affected packages\n\n- `tough >= 0.0.0-0, < 0.7.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tough 0.7.1`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}