Home > Vulnerability Database > CVE-2024-47534

Mend.io Vulnerability Database

CVE-2024-47534

Date: October 1, 2024

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

Language: Go

Severity Score

0.0

Related Resources (9)

Url: https://github.com/theupdateframework/go-tuf

Url: https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819

Url: https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d

Url: https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-47534

Url: https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j

Url: https://pkg.go.dev/vuln/GO-2024-3166

Url: https://github.com/theupdateframework/tuf-conformance/pull/115

Url: https://www.mend.io/vulnerability-database/CVE-2024-47534

Weakness Type (CWE)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-362

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE