Update Rust crate tough to 0.20.0 [SECURITY] #7889

oxide-renovate · 2025-03-28T15:04:25Z

This PR contains the following updates:

Package	Type	Update	Change
tough	workspace.dependencies	minor	`0.19.0` -> `0.20.0`

GitHub Vulnerability Alerts

CVE-2025-2887

Summary

When updating the snapshot role, TUF clients should ensure that any previously encountered targets or delegated targets metadata files continue to be present in new snapshot metadata files. Likewise, the new targets and delegated targets metadata versions must be greater than or equal to the previously encountered versions. While tough will perform this check for targets metadata files, it did not perform this check for delegated targets files.

Impact

tough could fail to detect cases where delegated targets metadata was removed or rolled back to a previous version. As a result, tough could trust and download outdated targets that it should reject.

Impacted versions: < v0.20.0

Patches

A fix for this issue is available in tough version 0.20.0 and later. Customers are advised to upgrade to version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There is no recommended work around. Customers are advised to upgrade to version 0.20.0 or the latest version.

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Acknowledgement

We would like to thank Google for collaborating on this issue through the coordinated vulnerability disclosure process.

CVE-2025-2888

Summary

TUF repositories use the timestamp role to protect against rollback events by enabling an automated process to periodically sign the role's metadata. While tough will ensure that the version of snapshot metadata in new timestamp metadata files was always greater than or equal to the previously trusted version, it will only do so after persisting the timestamp metadata to its cache.

Impact

If the tough client successfully detects a rollback event in which timestamp metadata contains outdated snapshot metadata, the invalid timestamp metadata will still be persisted to cache as trusted. tough may then subsequently incorrectly identify valid timestamp metadata as being rolled back, preventing the client from consuming valid updates.

Impacted versions: < v0.20.0

Patches

A fix for this issue is available in tough version 0.20.0 and later. Customers are advised to upgrade to version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There is no recommended work around. Customers are advised to upgrade to version 0.20.0 or the latest version.

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Acknowledgement

We would like to thank Google for collaborating on this issue through the coordinated vulnerability disclosure process.

CVE-2025-2885

Summary

When updating the root role, a TUF client must establish a trusted line of continuity to the latest set of keys. While sequentially downloading new versions of the root metadata file, tough will not check that the root object version it received was the next sequential version from the previously trusted root metadata.

Impact

The tough client will trust an outdated or rotated root role in the event that an actor with control of the storage medium of a trusted TUF repository inappropriately replaced the contents of one of the root metadata files with an adequately signed previous version. As a result, tough could trust content associated with a previous root role.

Impacted versions: < v0.20.0

Patches

A fix for this issue is available in tough version 0.20.0 and later. Customers are advised to upgrade to version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There is no recommended work around. Customers are advised to upgrade to version 0.20.0 or the latest version.

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Acknowledgement

We would like to thank Google for collaborating on this issue through the coordinated vulnerability disclosure process.

CVE-2025-2886

Summary

Delegations are a mechanism defined by the TUF specification that allow multiple different identities to provide and sign content within a single repository. Terminating delegations and delegation priority give a TUF repository unambiguous control over how overlapping delegations are resolved. tough erroneously will not terminate a search as required, and will accept information from a lower-priority delegation that should have been ignored.

Impact

When interacting with TUF repositories that use delegations, the tough client could fetch targets owned by the incorrect role. An actor which had delegated ownership of a subset of a TUF repository could provide arbitrary contents to tough clients for targets owned by the delegating identity.

Impacted versions: < v0.20.0

Patches

A fix for this issue is available in tough version 0.20.0 and later. Customers are advised to upgrade to version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There is no recommended work around. Customers are advised to upgrade to version 0.20.0 or the latest version.

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Acknowledgement

We would like to thank Google for collaborating on this issue through the coordinated vulnerability disclosure process.

GHSA-j8x2-777p-23fc

Summary

In a TUF repository, the targets role’s signature indicates which target files are trusted by clients. The role can delegate full or partial trust to other roles, meaning that that role is trusted to sign target file metadata. Delegated roles can further delegate trust to other delegated roles. When searching for metadata about a given target, tough failed to detect cyclical role delegations.

Impact

When interacting with TUF repositories which contain cyclical role delegations, tough will fail to detect the cycles and will exhaust its stack while recursively searching the delegation graph. The exhausted call stack will cause the process to abort.

Impacted versions: < v0.20.0

Patches

A fix for this issue is available in tough version 0.20.0 and later. Customers are advised to upgrade to version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There is no recommended work around. Customers are advised to upgrade to version 0.20.0 or the latest version.

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Acknowledgement

We would like to thank Google for collaborating on this issue through the coordinated vulnerability disclosure process.

Release Notes

awslabs/tough (tough)

`v0.20.0`

Compare Source

Fixes

Apply fixes for GHSA-5vmp-m5v2-hx47, GHSA-v4wr-j3w6-mxqc, GHSA-j8x2-777p-23fc, GHSA-76g3-38jv-wxh4, GHSA-q6r9-r9pw-4cf7
Detect duplicate keyids when verifying roles (094f0877)
Use the update start time when checking for signature expiry, rather than the current time (0eeb60ae)
Always store root.json in the datastore (thanks @AdamKorcz, @jku!) (7573eb97)

Changes

Add a permissive argument to find_target(), allowing the caller to cease a search when a terminating delegation is encountered (c5ee1718)
Add terminating argument to RepositoryEditor::delegate_role() and RepositoryEditor::add_role() to enable adding terminating delegations (598111f8)
Dependency updates

Configuration

📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - "after 8pm,before 6am" in timezone America/Los_Angeles.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

oxide-renovate · 2025-03-28T15:04:26Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package [email protected] --precise 0.20.0
    Updating crates.io index
error: failed to select a version for the requirement `tough = "^0.19.0"`
candidate versions found which didn't match: 0.20.0
location searched: crates.io index
required by package `tufaceous-lib v0.1.0 (https://github.com/oxidecomputer/tufaceous?branch=main#69e2896b)`
    ... which satisfies git dependency `tufaceous-lib` (locked to 0.1.0) of package `omicron-nexus v0.1.0 (/tmp/renovate/repos/github/oxidecomputer/omicron/nexus)`
    ... which satisfies path dependency `omicron-nexus` (locked to 0.1.0) of package `omicron-omdb v0.1.0 (/tmp/renovate/repos/github/oxidecomputer/omicron/dev-tools/omdb)`

sunshowers · 2025-03-31T21:02:52Z

sled-agent/bootstrap-agent-api/src/lib.rs

    pub name: String,
-    pub version: Version,


Had to do some minor code updates because tufaceous has some changes.

oxide-renovate · 2025-03-31T21:14:39Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

sunshowers · 2025-03-31T21:53:56Z

update-common/src/artifacts/artifacts_with_plan.rs

@@ -214,7 +214,7 @@ impl ArtifactsWithPlan {
                .repo()
                .targets()
                .signed
-                .find_target(&target_name)
+                .find_target(&target_name, false)


Used permissive = false here per @iliana.

Update Rust crate tough to 0.20.0 [SECURITY]

85e2e67

oxide-renovate bot added the dependencies Pull requests that update a dependency file label Mar 28, 2025

sunshowers reviewed Mar 31, 2025

View reviewed changes

update tufaceous as well

b9f8fce

sunshowers force-pushed the renovate/crate-tough-vulnerability branch from c5947ae to b9f8fce Compare March 31, 2025 21:11

sunshowers enabled auto-merge (squash) March 31, 2025 21:27

sunshowers reviewed Mar 31, 2025

View reviewed changes

sunshowers merged commit f3cb67f into main Mar 31, 2025
19 checks passed

sunshowers deleted the renovate/crate-tough-vulnerability branch March 31, 2025 22:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Rust crate tough to 0.20.0 [SECURITY] #7889

Update Rust crate tough to 0.20.0 [SECURITY] #7889

oxide-renovate bot commented Mar 28, 2025 •

edited

Loading

oxide-renovate bot commented Mar 28, 2025

sunshowers Mar 31, 2025

oxide-renovate bot commented Mar 31, 2025

sunshowers Mar 31, 2025

Update Rust crate tough to 0.20.0 [SECURITY] #7889

Update Rust crate tough to 0.20.0 [SECURITY] #7889

Conversation

oxide-renovate bot commented Mar 28, 2025 • edited Loading

GitHub Vulnerability Alerts

Summary

Impact

Patches

Workarounds

References

Acknowledgement

Summary

Impact

Patches

Workarounds

References

Acknowledgement

Summary

Impact

Patches

Workarounds

References

Acknowledgement

Summary

Impact

Patches

Workarounds

References

Acknowledgement

Summary

Impact

Patches

Workarounds

References

Acknowledgement

Release Notes

Fixes

Changes

Configuration

oxide-renovate bot commented Mar 28, 2025

⚠️ Artifact update problem

File name: Cargo.lock

Choose a reason for hiding this comment

oxide-renovate bot commented Mar 31, 2025

Edited/Blocked Notification

Choose a reason for hiding this comment

oxide-renovate bot commented Mar 28, 2025 •

edited

Loading