tough (crates.io)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.22.0 or later clears every advisory below that has a fix.

Upgrade commands

cargo

cargo update -p tough --precise 0.22.0

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-4v58-8p28-2rq3 awslabs/tough is Missing Delegated Metadata Validation	Medium EPSS 0.25%	`>= 0.9.0, < 0.22.0`	`0.22.0`
GHSA-8m7c-8m39-rv4x awslabs/tough Delegated Roles have a Signature Threshold Bypass	Medium EPSS 0.28%	`< 0.22.0`	`0.22.0`
GHSA-j8x2-777p-23fc tough cyclic delegation graphs are not detected	Low	`< 0.20.0`	`0.20.0`
GHSA-76g3-38jv-wxh4 tough timestamp metadata is cached when it fails snapshot rollback check	Medium EPSS 0.33%	`< 0.20.0`	`0.20.0`
GHSA-q6r9-r9pw-4cf7 tough failure to detect delegated target rollback	Medium EPSS 0.33%	`< 0.20.0`	`0.20.0`
GHSA-v4wr-j3w6-mxqc tough terminating targets role delegations are not respected	Medium EPSS 0.33%	`< 0.20.0`	`0.20.0`
GHSA-5vmp-m5v2-hx47 tough root metadata version is not checked for sequential versioning	Medium EPSS 0.33%	`< 0.20.0`	`0.20.0`
GHSA-r56q-vv3c-6g9c Improper sanitization of delegated role names	High EPSS 1.28%	`< 0.12.0`	`0.12.0`
GHSA-x3r5-q6mj-m485 Improper sanitization of target names	High EPSS 1.11%	`< 0.12.0`	`0.12.0`
GHSA-5q2r-92f9-4m49 Improper verification of signature threshold in tough	High EPSS 1.36%	`>= 0.0.0-0, < 0.7.1`	`0.7.1`
GHSA-5q2r-92f9-4m49 Improper verification of signature threshold in tough	High EPSS 1.36%	`< 0.7.1`	`0.7.1`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor