SB2022072617 - Security restrictions bypass in Go implementation of The Update Framework (TUF)
Published: July 26, 2022
Security Bulletin ID
SB2022072617
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper validation of integrity check value (CVE-ID: CVE-2022-29173)
The vulnerability allows a remote attacker to bypass expected security restrictions.
The vulnerability exists due to incorrect implementation of the client workflow for updating the metadata files for roles other than the root role. Checks for rollback attacks are not implemented correctly, as a result a remote attacker can force clients to install older versions of software that may contain security vulnerabilities.
Remediation
Install update from vendor's website.