Junglewise Threat Intelligence

CVE-2022-29173: GO-2022-0444 - Version rollback attack in github.com/theupdateframework/go-tuf

CVE-2022-29173 · Severity: low · CVSS 3.1 · Published 2022-07-01

Technologies: github.com/theupdateframework/go-tuf (Go). Vendors: Go.

Executive brief

Version rollback attack in github.com/theupdateframework/go-tuf

Affected products

Go github.com/theupdateframework/go-tuf

Related threats

GO-2022-1004 - Improper handling of keys in github.com/theupdateframework/go-tuf
Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata
The Update Framework go-tuf signature threshold bypass via duplicate Key IDs