-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from 1) not using previous metadata versions for validation and 2) premature persistence of metadata. Key issues were in decodeTimestamp/decodeSnapshot which handle version validation logic, and getLocalMeta which manages trusted state loading. The timestamp/snapshot metadata saving (SetMeta) occurred before full validation in the workflow. The util.TimestampFileMetaEqual function's strict requirements could bypass spec-mandated checks. Commit fixes show added version comparisons (e.g., snapshot.Meta['targets.json'].Version checks) and corrected validation order.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/theupdateframework/go-tuf | go | < 0.3.0 | 0.3.0 |
KEV Misses 88% of Exploited CVEs- Get the report