CVE-2024-47534: theupdateframework go-tuf Race Condition
CVSS: 8.2v4.0HighDeferred
AliasesUBUNTU-CVE-2024-47534CGA-282v-wgv9-w87pCGA-2h79-j529-xh35CGA-2jh7-rj24-5v5fCGA-3376-86m3-8gwcCGA-3942-xv66-g5xvCGA-3mfp-xpr4-hp3gCGA-49c4-m72m-fp6jCGA-4ppf-xpf3-c6j8CGA-4r68-rp55-26crCGA-5745-prmp-7c68CGA-5cmv-p4q2-j7pjCGA-675c-gvwc-c98fCGA-7p2w-hw68-6m56CGA-7w95-jfc9-f3m3CGA-83jm-jrr7-wg78CGA-8f42-h5m4-32w4CGA-8gvv-vrh2-8c79CGA-927v-5m9v-qxjcCGA-96xg-h5gw-c246CGA-9gv7-r754-9q4wCGA-9p93-qp3r-q3f9CGA-9w6x-h9cx-339rCGA-c3hm-84r6-6wqvCGA-cm4v-qj2w-6vq7CGA-cp64-xjgm-8vjhCGA-cq86-4cmq-q8qgCGA-cx64-2h63-7v2pCGA-fh29-39h7-9q74CGA-fv58-46c9-7936CGA-fxqf-6575-xm22CGA-g5wv-wx65-x49hCGA-gxc2-997h-mfxvCGA-h45f-xfhj-jrq9CGA-j7vr-pp4w-r3j2CGA-mrm7-v26v-c28qCGA-p373-cg36-7jxmCGA-p6qg-gpr9-74v3CGA-pxvq-gf9j-2x6jCGA-q37x-hr3x-5866CGA-qh7p-2fgh-j48wCGA-qqxr-c75h-8x4vCGA-r5cm-qcv2-cv62CGA-r894-8r6h-xc4hCGA-r9v7-6p4q-3534CGA-rp6h-3273-9rp2CGA-rvhr-q558-mg9xCGA-v55c-7wrf-jv3qCGA-v589-g97h-xfrxCGA-v845-98gg-5grpCGA-v9x9-m9qf-qhv2CGA-w3fj-j6gg-9jffCGA-xrqh-f783-hrg6GHSA-4f8r-qqr9-fq8jGO-2024-3166CGA-22q5-fw44-r46cCGA-286m-g9g9-jjwvCGA-32x3-xxq9-8gvvCGA-45gq-hq88-4pp7CGA-4xph-r28q-53qmCGA-56gp-rwhf-p6vmCGA-58g2-pmj9-8hm6CGA-655h-gj7q-cgqgCGA-66rj-c5hj-3g7pCGA-799r-359m-rgmjCGA-92g3-gp5j-q5wfCGA-9r8h-ph2g-34rhCGA-c2cf-g5gh-xmjvCGA-ffwp-r979-pg78CGA-g225-cv25-fxvmCGA-g5q6-f768-wc4xCGA-gg99-29mw-jpj3CGA-hhcf-p5wf-4qxpCGA-j55v-xxg3-7c34CGA-mjwr-q4qp-jpj3CGA-q2wq-j947-fh2hCGA-rj3w-m29g-g2vqCGA-rv29-r8jw-8xqrCGA-xh52-vxrp-4v56
Published 01-10-2024Last modified 21-11-2024
Vulnerability summary
CVE-2024-47534 is a high (CVSS 8.2) Race Condition vulnerability in theupdateframework go-tuf. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities.
CVSS score
8.2/10
010
High · v4.0 (CVE.org)EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 8Timeline
- 01-10-2024PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 8.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSources6 sources · 8.2–8.7
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NDiffers
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesSingle source
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 18-09-2026
18-09-202618-10-2026
EPSS score0.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard38 products
- aactl< 0.4.12-r37
- apko< 0.30.20-r0
- chainctl< 0.2.59-r0
- cosign< 3.0.2-r1
- cosign-fips< 3.0.2-r1
Wolfi26 products
- aactl< 0.4.12-r37
- apko< 0.30.20-r0
- cosign< 3.0.2-r1
- falcoctl< 0.11.4-r1
- flux-source-controller< 1.7.3-r0
Github.com/theupdateframework/go-tuf1 product
- v2< 2.0.1
Theupdateframework1 product
- go-tuf≥ 2.0.0, < 2.0.1
Ubuntu1 product
- golang-github-endophage-gotufAll versions (No fix recorded)
5 vendors · 67 products
References
11 links- github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8jX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151dX Refsource MISCFIXWEB
- github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819X Refsource MISCREPORTFIXWEB
