PT-2026-3904

Name of the Vulnerable Software and Affected Versions go-tuf versions 2.0.0 through 2.3.0 Description go-tuf, a Go implementation of The Update Framework TUF, is susceptible to a condition where a compromised or misconfigured repository can have signature thresholds set to 0. This effectively...

EUVD-2022-2733

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2024-47534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to A, and t...

SUSE CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

GO-2024-3166 Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf

Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf...

CVE-2024-47534

A flaw was found in the go-tuf package. Due to incorrect delegation lookups, the go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and then to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A", then "B", then...

GHSA-4F8R-QQR9-FQ8J Incorrect delegation lookups can make go-tuf download the wrong artifact

During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact. We have come across this issue in the...

Incorrect delegation lookups can make go-tuf download the wrong artifact

During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact. We have come across this issue in the...

CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

UBUNTU-CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534

CVE-2024-47534 affects the go-tuf Go TUF client. The root cause is incorrect delegation tracing: when targets delegate to A and B, and B delegates to C, the client may traverse B→C→A instead of A→B→C, due to the way GetRolesForTarget maps are handled in metadata.go. This can cause the client to t...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

go-tuf 竞争条件问题漏洞

go-tuf is an open source framework from The Update Framework for protecting software update systems. A competitive condition issue vulnerability exists in go-tuf that stems from inconsistent tracking of delegates...

PT-2024-32647 · Go-Tuf +1 · Go-Tuf +1

Name of the Vulnerable Software and Affected Versions: go-tuf versions prior to 2.0.1 Description: The go-tuf client inconsistently traces the delegations, which can result in downloading the wrong artifact. For example, if targets delegate to "A" and "B", and "B" delegates to "C", the client...

GHSA-66X3-6CW3-V5GJ Improper Validation of Integrity Check Value in go-tuf

Impact go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software whic...

Improper Validation of Integrity Check Value in go-tuf

Impact go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software whic...

CVE-2022-29173

A flaw was found in go-tuf. This flaw allows an attacker to cause clients to install older software than the software the client previously knew to be available and may include software with known vulnerabilities...