{"schemaVersion":3,"id":"CVE-2024-47534","aliases":["UBUNTU-CVE-2024-47534","CGA-282v-wgv9-w87p","CGA-2h79-j529-xh35","CGA-2jh7-rj24-5v5f","CGA-3376-86m3-8gwc","CGA-3942-xv66-g5xv","CGA-3mfp-xpr4-hp3g","CGA-49c4-m72m-fp6j","CGA-4ppf-xpf3-c6j8","CGA-4r68-rp55-26cr","CGA-5745-prmp-7c68","CGA-5cmv-p4q2-j7pj","CGA-675c-gvwc-c98f","CGA-7p2w-hw68-6m56","CGA-7w95-jfc9-f3m3","CGA-83jm-jrr7-wg78","CGA-8f42-h5m4-32w4","CGA-8gvv-vrh2-8c79","CGA-927v-5m9v-qxjc","CGA-96xg-h5gw-c246","CGA-9gv7-r754-9q4w","CGA-9p93-qp3r-q3f9","CGA-9w6x-h9cx-339r","CGA-c3hm-84r6-6wqv","CGA-cm4v-qj2w-6vq7","CGA-cp64-xjgm-8vjh","CGA-cq86-4cmq-q8qg","CGA-cx64-2h63-7v2p","CGA-fh29-39h7-9q74","CGA-fv58-46c9-7936","CGA-fxqf-6575-xm22","CGA-g5wv-wx65-x49h","CGA-gxc2-997h-mfxv","CGA-h45f-xfhj-jrq9","CGA-j7vr-pp4w-r3j2","CGA-mrm7-v26v-c28q","CGA-p373-cg36-7jxm","CGA-p6qg-gpr9-74v3","CGA-pxvq-gf9j-2x6j","CGA-q37x-hr3x-5866","CGA-qh7p-2fgh-j48w","CGA-qqxr-c75h-8x4v","CGA-r5cm-qcv2-cv62","CGA-r894-8r6h-xc4h","CGA-r9v7-6p4q-3534","CGA-rp6h-3273-9rp2","CGA-rvhr-q558-mg9x","CGA-v55c-7wrf-jv3q","CGA-v589-g97h-xfrx","CGA-v845-98gg-5grp","CGA-v9x9-m9qf-qhv2","CGA-w3fj-j6gg-9jff","CGA-xrqh-f783-hrg6","GHSA-4f8r-qqr9-fq8j","GO-2024-3166","CGA-22q5-fw44-r46c","CGA-286m-g9g9-jjwv","CGA-32x3-xxq9-8gvv","CGA-45gq-hq88-4pp7","CGA-4xph-r28q-53qm","CGA-56gp-rwhf-p6vm","CGA-58g2-pmj9-8hm6","CGA-655h-gj7q-cgqg","CGA-66rj-c5hj-3g7p","CGA-799r-359m-rgmj","CGA-92g3-gp5j-q5wf","CGA-9r8h-ph2g-34rh","CGA-c2cf-g5gh-xmjv","CGA-ffwp-r979-pg78","CGA-g225-cv25-fxvm","CGA-g5q6-f768-wc4x","CGA-gg99-29mw-jpj3","CGA-hhcf-p5wf-4qxp","CGA-j55v-xxg3-7c34","CGA-mjwr-q4qp-jpj3","CGA-q2wq-j947-fh2h","CGA-rj3w-m29g-g2vq","CGA-rv29-r8jw-8xqr","CGA-xh52-vxrp-4v56"],"status":"published","duplicateOf":null,"title":null,"description":"go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to \"A\", and to \"B\", and \"B\" delegates to \"C\", then the client should trace the delegations in the order \"A\" then \"B\" then \"C\" but it may incorrectly trace the delegations \"B\"->\"C\"->\"A\". This vulnerability is fixed in 2.0.1.","dates":{"published":"2024-10-01T15:17:47.363Z","modified":"2024-11-21T16:56:38.062Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.2,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00507,"percentile":0.42022,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00507},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00507,"percentile":0.42022}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00507,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00507,"percentile":0.42022}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","description":"The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/362.html"}],"affected":[{"vendor":"chainguard","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r37","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apko","name":"apko","label":"apko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apko","purlType":"apk","versions":[{"text":"< 0.30.20-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.30.20-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"chainctl","name":"chainctl","label":"chainctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/chainctl","purlType":"apk","versions":[{"text":"< 0.2.59-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.59-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cosign","name":"cosign","label":"cosign","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cosign","purlType":"apk","versions":[{"text":"< 3.0.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cosign-fips","name":"cosign-fips","label":"cosign-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cosign-fips","purlType":"apk","versions":[{"text":"< 3.0.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"docker-credential-cgr","name":"docker-credential-cgr","label":"docker-credential-cgr","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/docker-credential-cgr","purlType":"apk","versions":[{"text":"< 0.2.59-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.59-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl","name":"falcoctl","label":"falcoctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl","purlType":"apk","versions":[{"text":"< 0.11.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcoctl-fips","name":"falcoctl-fips","label":"falcoctl-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcoctl-fips","purlType":"apk","versions":[{"text":"< 0.11.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.7.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.3-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-source-controller-fips","name":"flux-source-controller-fips","label":"flux-source-controller-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-source-controller-fips","purlType":"apk","versions":[{"text":"< 1.7.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gh","name":"gh","label":"gh","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gh","purlType":"apk","versions":[{"text":"< 2.83.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.83.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitsign","name":"gitsign","label":"gitsign","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitsign","purlType":"apk","versions":[{"text":"< 0.13.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubescape","purlType":"apk","versions":[{"text":"< 3.0.18-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.18-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"melange","name":"melange","label":"melange","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/melange","purlType":"apk","versions":[{"text":"< 0.32.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.32.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"neuvector-sigstore-interface","name":"neuvector-sigstore-interface","label":"neuvector-sigstore-interface","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/neuvector-sigstore-interface","purlType":"apk","versions":[{"text":"< 0_git20250629-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20250629-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"neuvector-sigstore-interface-fips","name":"neuvector-sigstore-interface-fips","label":"neuvector-sigstore-interface-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/neuvector-sigstore-interface-fips","purlType":"apk","versions":[{"text":"< 0_git20251020-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20251020-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller","purlType":"apk","versions":[{"text":"< 0.9.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-tester","name":"policy-controller-tester","label":"policy-controller-tester","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-tester","purlType":"apk","versions":[{"text":"< 0.9.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"policy-controller-tester-fips","name":"policy-controller-tester-fips","label":"policy-controller-tester-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/policy-controller-tester-fips","purlType":"apk","versions":[{"text":"< 0.13.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor","name":"rekor","label":"rekor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-backfill-index","name":"rekor-backfill-index","label":"rekor-backfill-index","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-backfill-index","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-cli","name":"rekor-cli","label":"rekor-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-cli","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-server","name":"rekor-server","label":"rekor-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-server","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sigstore-scaffolding-fips-tuf-server","name":"sigstore-scaffolding-fips-tuf-server","label":"sigstore-scaffolding-fips-tuf-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sigstore-scaffolding-fips-tuf-server","purlType":"apk","versions":[{"text":"< 0.7.25-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.25-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sigstore-scaffolding-tuf-server","name":"sigstore-scaffolding-tuf-server","label":"sigstore-scaffolding-tuf-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sigstore-scaffolding-tuf-server","purlType":"apk","versions":[{"text":"< 0.7.25-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.7.26-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.25-r1 | < 0.7.26-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.7.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-agent","name":"spire-agent","label":"spire-agent","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-agent","purlType":"apk","versions":[{"text":"< 1.13.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.3-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spire-agent-fips","name":"spire-agent-fips","label":"spire-agent-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spire-agent-fips","purlType":"apk","versions":[{"text":"< 1.13.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains","purlType":"apk","versions":[{"text":"< 0.26.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.26.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tekton-chains-fips","name":"tekton-chains-fips","label":"tekton-chains-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tekton-chains-fips","purlType":"apk","versions":[{"text":"< 0.22.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn","purlType":"apk","versions":[{"text":"< 0.42.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.42.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn-fips","name":"tkn-fips","label":"tkn-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn-fips","purlType":"apk","versions":[{"text":"< 0.42.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.42.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"trivy","name":"trivy","label":"trivy","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/trivy","purlType":"apk","versions":[{"text":"< 0.67.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"trivy-fips","name":"trivy-fips","label":"trivy-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/trivy-fips","purlType":"apk","versions":[{"text":"< 0.67.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vexctl","name":"vexctl","label":"vexctl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vexctl","purlType":"apk","versions":[{"text":"< 0.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wolfictl","name":"wolfictl","label":"wolfictl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wolfictl","purlType":"apk","versions":[{"text":"< 0.38.21-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.38.21-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zarf","name":"zarf","label":"zarf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zarf","purlType":"apk","versions":[{"text":"< 0.65.1-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.65.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.65.1-r1 | < 0.65.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zot","name":"zot","label":"zot","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zot","purlType":"apk","versions":[{"text":"< 2.1.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r37","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apko","name":"apko","label":"apko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apko","purlType":"apk","versions":[{"text":"< 0.30.20-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.30.20-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cosign","name":"cosign","label":"cosign","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cosign","purlType":"apk","versions":[{"text":"< 3.0.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"falcoctl","name":"falcoctl","label":"falcoctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/falcoctl","purlType":"apk","versions":[{"text":"< 0.11.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.4-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"flux-source-controller","name":"flux-source-controller","label":"flux-source-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/flux-source-controller","purlType":"apk","versions":[{"text":"< 1.7.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.3-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"gh","name":"gh","label":"gh","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/gh","purlType":"apk","versions":[{"text":"< 2.83.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.83.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"gitsign","name":"gitsign","label":"gitsign","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/gitsign","purlType":"apk","versions":[{"text":"< 0.13.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubescape","purlType":"apk","versions":[{"text":"< 3.0.18-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.18-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"melange","name":"melange","label":"melange","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/melange","purlType":"apk","versions":[{"text":"< 0.32.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.32.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"neuvector-sigstore-interface","name":"neuvector-sigstore-interface","label":"neuvector-sigstore-interface","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/neuvector-sigstore-interface","purlType":"apk","versions":[{"text":"< 0_git20250629-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0_git20250629-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller","name":"policy-controller","label":"policy-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller","purlType":"apk","versions":[{"text":"< 0.9.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"policy-controller-tester","name":"policy-controller-tester","label":"policy-controller-tester","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/policy-controller-tester","purlType":"apk","versions":[{"text":"< 0.9.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor","name":"rekor","label":"rekor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor-backfill-index","name":"rekor-backfill-index","label":"rekor-backfill-index","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor-backfill-index","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor-cli","name":"rekor-cli","label":"rekor-cli","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor-cli","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor-server","name":"rekor-server","label":"rekor-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor-server","purlType":"apk","versions":[{"text":"< 1.3.6-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.6-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sigstore-scaffolding-tuf-server","name":"sigstore-scaffolding-tuf-server","label":"sigstore-scaffolding-tuf-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sigstore-scaffolding-tuf-server","purlType":"apk","versions":[{"text":"< 0.7.25-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.7.26-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.25-r1 | < 0.7.26-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"slsa-verifier","name":"slsa-verifier","label":"slsa-verifier","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/slsa-verifier","purlType":"apk","versions":[{"text":"< 2.7.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"spire-agent","name":"spire-agent","label":"spire-agent","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/spire-agent","purlType":"apk","versions":[{"text":"< 1.13.3-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.3-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tekton-chains","name":"tekton-chains","label":"tekton-chains","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tekton-chains","purlType":"apk","versions":[{"text":"< 0.26.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.26.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tkn","purlType":"apk","versions":[{"text":"< 0.42.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.42.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"trivy","name":"trivy","label":"trivy","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/trivy","purlType":"apk","versions":[{"text":"< 0.67.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vexctl","name":"vexctl","label":"vexctl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vexctl","purlType":"apk","versions":[{"text":"< 0.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"wolfictl","name":"wolfictl","label":"wolfictl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/wolfictl","purlType":"apk","versions":[{"text":"< 0.38.21-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.38.21-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zarf","name":"zarf","label":"zarf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zarf","purlType":"apk","versions":[{"text":"< 0.65.1-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.65.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.65.1-r1 | < 0.65.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zot","name":"zot","label":"zot","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zot","purlType":"apk","versions":[{"text":"< 2.1.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.1-r3","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"golang-github-endophage-gotuf","name":"golang-github-endophage-gotuf","label":"golang-github-endophage-gotuf","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/golang-github-endophage-gotuf","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/theupdateframework/go-tuf","product":"v2","name":"github.com/theupdateframework/go-tuf/v2","label":"v2","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2","purlType":"golang","versions":[{"text":"< 2.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.1","eol":null,"hubHref":null},{"vendor":"theupdateframework","product":"go-tuf","name":"go-tuf","label":"go-tuf","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.0, < 2.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0, < 2.0.1","eol":null,"hubHref":"/vendor/theupdateframework/go-tuf"}],"affectedCount":67,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j","label":"github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB"]},{"url":"https://github.com/theupdateframework/tuf-conformance/pull/115","label":"github.com/theupdateframework/tuf-conformance/pull/115","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB"]},{"url":"https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d","label":"github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819","label":"github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB"]},{"url":"https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580","label":"github.com/theupdateframework/…","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB"]},{"url":"https://ubuntu.com/security/CVE-2024-47534","label":"ubuntu.com/security/CVE-2024-47534","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47534","label":"www.cve.org/CVERecord?id=CVE-2024-47534","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47534.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47534.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47534","label":"nvd.nist.gov/vuln/detail/CVE-2024-47534","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/theupdateframework/go-tuf","label":"github.com/theupdateframework/go-tuf","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3166","label":"pkg.go.dev/vuln/GO-2024-3166","hostname":"pkg.go.dev","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:0350-1","OPENSUSE-SU-2024:14447-1","SUSE-SU-2024:3911-1"],"duplicates":[],"related":["CGA-29M6-VCQG-GW2W","CGA-8784-5948-H3QW","CGA-GMCP-6CP9-3V87","CGA-H87F-HHXC-PG5M","CGA-QJJX-7RR6-52H2","OPENSUSE-SU-2024:0350-1","OPENSUSE-SU-2024:14447-1","SUSE-SU-2024:3911-1"]},"timeline":[{"kind":"published","date":"2024-10-01T15:17:47.363Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-11-21T16:56:38.062Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:08:07.471Z","stale":false,"partial":false}}