go-tuf vulnerabilities

go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended LocalMetadataDir cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification of TUF metadata files at rest or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always ensure that TUF metadata roles are configured with a threshold of at least 1.

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to 2.3.1, if the TUF repository (or any mirror) returns invalid TUF metadata JSON (valid JSON but not well-formed TUF metadata), the client panics during parsing, causing denial of service. The panic occurs before signature validation, so a compromised repository/mirror/cache can DoS clients without any signing key.