openSUSE Security Advisory (SUSE-SU-2024:3911-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-47534 vulnerabilities

Vulnerabilities for packages: policy-controller, gh, melange, zarf, policy-controller-fips, aactl, cosign, tkn, spire-server, neuvector-sigstore-interface, zot, trivy, sigstore-scaffolding, tekton-chains, falcoctl-fips, flux-source-controller-fips, cosign-fips, neuvector-sigstore-interface-fips,...

CVE-2024-47534 vulnerabilities

Vulnerabilities for packages: zot, zarf, tkn, trivy, flux-source-controller, gh, slsa-verifier, wolfictl, neuvector-sigstore-interface, vexctl, falcoctl, sigstore-scaffolding, cosign, aactl, tekton-chains, apko, melange, rekor, gitsign, spire-server, policy-controller, kubescape...

CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...