IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2024-10-01 16:15

MODIFIED

2024-11-21 17:15

EPSS (Prob. Exploit)

0.51%

Top 57.6%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-01

> DESCRIPTION

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-4f8r-qqr9-fq8j HIGH

Incorrect delegation lookups can make go-tuf download the wrong artifact

AFFECTED PACKAGES:

GO / github.com/theupdateframework/go-tuf/v2

< 2.0.1

Fixed in: 2.0.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Incorrect delegation lookups can make go-tuf download the wrong artifact

AFFECTED PACKAGES:

Unknown / Unknown

1 versions affected

ALIASES:

GHSA-4f8r-qqr9-fq8j, GO-2024-3166

> HISTORIQUE DES MODIFICATIONS

Première apparition

01/10/2024 16:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 14:54

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui