Detections
Analytics

SCA: security update for github.com/theupdateframework/go-tuf (GHSA-66x3-6cw3-v5gj)

high Tenable Cloud Security Plugin ID 411257

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the
 client workflow for updating the metadata files for roles other than the root role. Specifically, checks
 for rollback attacks are not implemented correctly meaning an attacker can cause clients to install
 software that is older than the software which the client previously knew to be available, and may include
 software with known vulnerabilities. In more detail, the client code of go-tuf has several issues in
 regards to preventing rollback attacks: 1. It does not take into account the content of any previously
 trusted metadata, if available, before proceeding with updating roles other than the root role (i.e.,
 steps 5.4.3.1 and 5.5.5 of the detailed client workflow). This means that any form of version verification
 done on the newly-downloaded metadata is made using the default value of zero, which always passes. 2. For
 both timestamp and snapshot roles, go-tuf saves these metadata files as trusted before verifying if the
 version of the metafiles they refer to is correct (i.e., steps 5.5.4 and 5.6.4 of the detailed client
 workflow). A fix is available in version 0.3.0 or newer. No workarounds are known for this issue apart
 from upgrading. (CVE-2022-29173)

See Also

https://github.com/advisories/GHSA-66x3-6cw3-v5gj

Plugin Details

Severity: High

ID: 411257

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2022-29173

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/5/2022

Vulnerability Publication Date: 5/5/2022

Reference Information

CVE: CVE-2022-29173

cwe: CWE-354