GHSA-77hh-43cm-v8j6: tuf's Metadata API: Targets.get_delegated_role() is missing input validation
N/A
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tuf | pip | >= 2.0.0, < 3.1.1 | 3.1.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description explicitly names tuf.api.metadata.Targets.get_delegated_role() as the primary function with missing input validation. The provided patches (both 77cb66bc and eb4834d9 show the same change) directly modify this function in tuf/api/metadata.py. The diff shows that a conditional check if succinct.is_delegated_role(delegated_role): was added. Before this change, if self.delegations.roles was None (indicating the use of succinct delegations, as self.delegations.succinct_roles would be used instead), the code would assign self.delegations.succinct_roles to role without verifying if the delegated_role string was actually a role defined within the succinct_roles object. This lack of validation is the core of the vulnerability. The description also mentions Targets.verify_delegate() and Targets.get_verification_result() as being impacted, likely because they use get_delegated_role() internally. However, the patch only directly modifies get_delegated_role(), so it's the most direct vulnerable function identifiable from the patch evidence.