x/vulndb: potential Go vuln in github.com/theupdateframework/go-tuf: CVE-2024-47534

[GoVulnBot]

Advisory CVE-2024-47534 references a vulnerability in the following Go modules:

Module
github.com/theupdateframework/go-tuf

Description:
go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-47534
• FIX: theupdateframework/go-tuf@f36420c
• FIX: Add first graph and target search test theupdateframework/tuf-conformance#115
• WEB: https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580
• WEB: GHSA-4f8r-qqr9-fq8j

Cross references:

• github.com/theupdateframework/go-tuf appears in 2 other report(s):
  • data/reports/GO-2022-0444.yaml (x/vulndb: potential Go vuln in github.com/theupdateframework/go-tuf: CVE-2022-29173 #444)
  • data/reports/GO-2022-1004.yaml (x/vulndb: potential Go vuln in github.com/theupdateframework/go-tuf: GHSA-3633-5h82-39pq #1004)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/theupdateframework/go-tuf
      vulnerable_at: 0.7.0
summary: CVE-2024-47534 in github.com/theupdateframework/go-tuf
cves:
    - CVE-2024-47534
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-47534
    - fix: https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819
    - fix: https://github.com/theupdateframework/tuf-conformance/pull/115
    - web: https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580
    - web: https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j
source:
    id: CVE-2024-47534
    created: 2024-10-01T17:01:21.166553174Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/619135 mentions this issue: data/reports: add 15 reports

[gopherbot]

Change https://go.dev/cl/620155 mentions this issue: data/reports: update GO-2024-3166