Multiple Path Traversal Variants in awslabs/tough

Missing Delegated Metadata Validation in awslabs/tough

Signature Threshold Bypass in awslabs/tough Delegated Roles

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories

During a snapshot rollback, the client incorrectly caches the timestamp metadata

During a target rollback, the client fails to detect the rollback for delegated targets

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root…