PT-2024-32647 · Go-Tuf+1 · Go-Tuf+1

Adamkorcz · Published 2024-10-01 · Updated 2024-11-05 · CVE-2024-47534

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions go-tuf versions prior to 2.0.1

Description The go-tuf client inconsistently traces the delegations, which can result in downloading the wrong artifact. For example, if targets delegate to "A" and "B", and "B" delegates to "C", the client should trace the delegations in the order "A" then "B" then "C", but it may incorrectly trace the delegations "B"->"C"->"A". This issue is related to the GetRolesForTarget function, which returns a map that causes this behavior.

Recommendations For go-tuf versions prior to 2.0.1, update to version 2.0.1 to fix the inconsistent delegation tracing issue. As a temporary workaround, consider reviewing and verifying the delegation paths manually to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2024-47534

GHSA-4F8R-QQR9-FQ8J

GO-2024-3166

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Suse

Go-Tuf

References · 80

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47534.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47534 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47534 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-47534 · Security Note
• https://ubuntu.com/security/CVE-2024-47534 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3166 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4f8r-qqr9-fq8j · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47534 · Vendor Advisory
• https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580 · Note
• https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819 · Note
• https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d · Note
• https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j · Note