# The Update Framework go-tuf signature threshold bypass via duplicate Key IDs

Source: https://junglewise.ai/threats/the-update-framework-go-tuf-signature-threshold-bypass-via-duplicate-8e445fe3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-16. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

Severity: low · CVSS 0 · Published 2022-09-16

The go-tuf library, which implements a framework for securing software update systems, contains a flaw in how it validates digital signatures. An attacker who can influence the metadata of a software repository could potentially bypass security thresholds by providing the same cryptographic key multiple times using different identifiers. This could allow a single malicious actor to appear as multiple authorized signers, potentially leading to the distribution of unauthorized or malicious software updates.

Technologies: [github.com/theupdateframework/go-tuf (Go)](https://junglewise.ai/threats/technologies/github-com-theupdateframework-go-tuf). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 0, published 16 September 2022.

**Which products and versions are affected?** github.com/theupdateframework/go-tuf (Go) < 0.3.2; The Update Framework Go-Tuf < 0.3.2.

**Is there a fix for This vulnerability?** A patch was published on 2022-09-08: Version 0.3.2 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/theupdateframework/go-tuf (Go) or The Update Framework Go-Tuf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in go-tuf clients prior to version 0.3.2 allows for an authentication bypass by alternate name (CWE-289). The root cause is the library's failure to deduplicate public keys when they are presented with different Key IDs (e.g., using different hash algorithms like SHA2-256 and SHA2-512 for the same key). If a TUF repository requires a threshold of N signatures, an attacker who controls a valid key can list that same key multiple times in the metadata under different IDs. If they convince other maintainers to sign this metadata, the client will incorrectly count the attacker's single signature multiple times, potentially meeting the required threshold with fewer unique signers than intended. This issue is resolved in version 0.3.2 by ensuring unique public keys are only counted once regardless of the Key ID used.

## Affected products

- The Update Framework (TUF) go-tuf < 0.3.2

## Timeline

- 2022-09-08: disclosed: Advisory published by the maintainers.
- 2022-09-16: advisory: GitHub Advisory GHSA-3633-5h82-39pq published.
- 2022-09-08: patched: Version 0.3.2 released with fix.

## References

- [https://api.github.com/users/cedricvanrompay-datadog](https://api.github.com/users/cedricvanrompay-datadog)
- [https://github.com/cedricvanrompay-datadog](https://github.com/cedricvanrompay-datadog)
- [https://api.github.com/users/cedricvanrompay-datadog/gists%7B/gist_id%7D](https://api.github.com/users/cedricvanrompay-datadog/gists%7B/gist_id%7D)
- [https://api.github.com/users/cedricvanrompay-datadog/repos](https://api.github.com/users/cedricvanrompay-datadog/repos)
- [https://avatars.githubusercontent.com/u/97546950?v=4](https://avatars.githubusercontent.com/u/97546950?v=4)
- [https://api.github.com/users/cedricvanrompay-datadog/events%7B/privacy%7D](https://api.github.com/users/cedricvanrompay-datadog/events%7B/privacy%7D)

## Related threats

- [GO-2022-1004 - Improper handling of keys in github.com/theupdateframework/go-tuf](https://junglewise.ai/threats/go-2022-1004-improper-handling-of-keys-in-github-com-theupdateframework-dae55071)
- [GO-2022-0444 - Version rollback attack in github.com/theupdateframework/go-tuf](https://junglewise.ai/threats/cve-2022-29173-improper-validation-of-integrity-check-value-in-go-tuf)