CVE-2024-47534

Description

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

Reserved 2024-09-25 | Published 2024-10-01 | Updated 2024-11-21 | Assigner GitHub_M

Problem types

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Product status

>= 2.0.0, < 2.0.1
affected

References

github.com/...go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j

github.com/theupdateframework/tuf-conformance/pull/115

github.com/...ommit/edc30b474f5afd4cc603e17149704d5aa605151d

github.com/...ommit/f36420caba9edbfdfd64f95a9554c0836d9cf819

github.com/...4e5b8ed6fe912b645e213c3b5/metadata/metadata.go

cve.org (CVE-2024-47534)

nvd.nist.gov (CVE-2024-47534)

Download JSON