tough

Rust / Cargo · Package

10 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Improper verification of signature threshold in toughCVE-2020-15093 · GHSA-5Q2R-92F9-4M49Version ranges need review.	tough	Rust / Cargo	High	Fix reported	2026-10-12
awslabs/tough is Missing Delegated Metadata ValidationCVE-2026-6967 · GHSA-4V58-8P28-2RQ3	tough tuftool	Rust / Cargo	High	Fix reported	2026-09-10
awslabs/tough Delegated Roles have a Signature Threshold BypassCVE-2026-6966 · GHSA-8M7C-8M39-RV4X	tough tuftool	Rust / Cargo	High	Fix reported	2026-09-10
Improper sanitization of target namesCVE-2021-41149 · GHSA-X3R5-Q6MJ-M485	tough	Rust / Cargo	High	Fix reported	2026-07-08
Improper sanitization of delegated role namesCVE-2021-41150 · GHSA-R56Q-VV3C-6G9C	tough	Rust / Cargo	High	Fix reported	2026-02-04
tough timestamp metadata is cached when it fails snapshot rollback checkCVE-2025-2888 · GHSA-76G3-38JV-WXH4	tough	Rust / Cargo	Medium	Fix reported	2025-10-15
tough failure to detect delegated target rollbackCVE-2025-2887 · GHSA-Q6R9-R9PW-4CF7	tough	Rust / Cargo	Medium	Fix reported	2025-10-15
tough terminating targets role delegations are not respectedCVE-2025-2886 · GHSA-V4WR-J3W6-MXQC	tough	Rust / Cargo	Medium	Fix reported	2025-10-15
tough root metadata version is not checked for sequential versioningCVE-2025-2885 · GHSA-5VMP-M5V2-HX47	tough	Rust / Cargo	Medium	Fix reported	2025-10-15
tough cyclic delegation graphs are not detectedGHSA-J8X2-777P-23FC	tough	Rust / Cargo	Low	Fix reported	2025-04-03