CVE-2024-47534CWE-362

Incorrect delegation lookups can make go-tuf download the wrong artifact

High · published October 1, 2024

CVSS v4.0
8.2
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2024-10-01T15:17Z
EPSS history
Timeline
  • 01 OCT 15:17Z
    Incorrect delegation lookups can make go-tuf download the wrong artifact
    cvelistv5