Skip to content
OpenAdvisories

Package · Go

github.com/theupdateframework/go-tuf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low —
    GHSA-3633-5h82-39pq

    Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

    ### Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf [clients](https://github.com/theupdateframework/go-tuf#client) <…

    github.com/theupdateframework/go-tuf Go
  • High 8.0
    CVE-2022-29173

    No protection against rollback attacks in go-tuf

    go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly me…

    theupdateframework go-tuf github.com/theupdateframework/go-tuf Go