Description
go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.
References (5)
Core 5
Core References
Issue Tracking x_refsource_misc
https://github.com/theupdateframework/tuf-conformance/pull/115
Vendor Advisory x_refsource_confirm
https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j
Patch x_refsource_misc
https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d
Patch x_refsource_misc
https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819
Scores
CVSS v4
8.2
EPSS
0.0026
EPSS Percentile
49.3%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-362
Status
published
Products (2)
theupdateframework/go-tuf
0 - 2.0.1Go
theupdateframework/go-tuf
>= 2.0.0, < 2.0.1
Published
Oct 01, 2024
Tracked Since
Feb 18, 2026