GHSA-r7vq-6425-j94w: 
Python vulnerability analysis and mitigation

The vulnerability (GHSA-r7vq-6425-j94w) affects Python-TUF versions 0.14.0 through 0.15.0, discovered in the _verify_root_self_signed() function introduced in v0.14.0. The function incorrectly counted multiple signatures by any new root key towards the new threshold during root metadata verification (GitHub Advisory).

The vulnerability lies in the verification process of self-signatures in new root metadata files. The _verify_root_self_signed() function would count multiple signatures from the same new root key separately towards the threshold, potentially allowing a single new root key to provide enough signatures to meet the threshold requirement (GitHub Advisory).

The impact of this vulnerability is considered low in severity. For successful exploitation, an attacker would need to: control a new root key, craft a new root metadata file with multiple signatures from this key meeting the threshold, obtain valid signatures from old trusted root keys, publish the metadata file, and cause clients to rotate to the new root metadata (GitHub Advisory).

A fix for this vulnerability is available in version 0.16.0 of Python-TUF. No alternative workarounds are known for this issue (GitHub Advisory).