GO-2022-1004

Source
https://storage.googleapis.com/go-vulndb/ID/GO-2022-1004.json
Aliases
Published
2022-09-21T15:07:26Z
Modified
2022-09-21T15:07:26Z
Details

An attacker with the ability to insert public keys into a TUF repository can cause clients to accept a staged change that has not been signed by the correct threshold of signatures.

References

Affected packages

Go / github.com/theupdateframework/go-tuf

github.com/theupdateframework/go-tuf

Affected ranges

Type
SEMVER
Events
Introduced
0
Fixed
0.3.2

Affected versions

Ecosystem specific 

{
    "imports": [
        {
            "symbols": [
                "DB.Unmarshal",
                "DB.UnmarshalIgnoreExpired",
                "DB.UnmarshalTrusted",
                "DB.Verify",
                "DB.VerifyIgnoreExpiredCheck",
                "DB.VerifySignatures"
            ],
            "path": "github.com/theupdateframework/go-tuf/verify"
        }
    ]
}

Database specific 

{
    "url": "https://pkg.go.dev/vuln/GO-2022-1004"
}