Junglewise Threat Intelligence

GO-2022-1004 - Improper handling of keys in github.com/theupdateframework/go-tuf

Severity: info · Published 2022-09-21

Technologies: github.com/theupdateframework/go-tuf (Go). Vendors: Go.

Executive brief

Improper handling of keys in github.com/theupdateframework/go-tuf

Affected products

Go github.com/theupdateframework/go-tuf

Related threats

Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata
The Update Framework go-tuf signature threshold bypass via duplicate Key IDs
GO-2022-0444 - Version rollback attack in github.com/theupdateframework/go-tuf