{"id":"CVE-2024-47534","aliases":["GHSA-4f8r-qqr9-fq8j","GO-2024-3166"],"title":"Incorrect delegation lookups can make go-tuf download the wrong artifact","summary":"Incorrect delegation lookups can make go-tuf download the wrong artifact","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"theupdateframework","product":"github.com/theupdateframework/go-tuf/v2","ecosystem":"go","affected":["github.com/theupdateframework/go-tuf/v2 < 2.0.1"],"patched":["github.com/theupdateframework/go-tuf/v2 2.0.1"],"published":"2024-10-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:19.201447374Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4f8r-qqr9-fq8j","references":[{"url":"https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47534"},{"url":"https://github.com/theupdateframework/tuf-conformance/pull/115"},{"url":"https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d"},{"url":"https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819"},{"url":"https://github.com/theupdateframework/go-tuf"},{"url":"https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580"},{"url":"https://pkg.go.dev/vuln/GO-2024-3166"}],"tags":["osv","go"],"epss":0.00507,"epssPercentile":0.42279,"ingestedAt":"2026-09-12T03:13:01.752Z","slug":"CVE-2024-47534","body":"## Overview\n\nDuring the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact. \n\nWe have come across this issue in the test in this PR: https://github.com/theupdateframework/tuf-conformance/pull/115.\n\nThe test - `test_graph_traversal` - sets up a repository with a series of delegations, invokes the clients `refresh()` and then checks the order in which the client traced the delegations. The test shows that the go-tuf client inconsistently traces the delegations in a wrong way. For example, [during one CI run](https://github.com/theupdateframework/tuf-conformance/pull/115#issuecomment-2275625542), the `two-level-delegations` test case triggered a wrong order. The delegations in this look as such:\n\n```python\n\"two-level-delegations\": DelegationsTestCase(\n        delegations=[\n            DelegationTester(\"targets\", \"A\"),\n            DelegationTester(\"targets\", \"B\"),\n            DelegationTester(\"B\", \"C\"),\n        ],\n        visited_order=[\"A\", \"B\", \"C\"],\n    ),\n```\n\nHere, `targets` delegate to `\"A\"`, and to `\"B\"`, and `\"B\"` delegates to `\"C\"`. The client should trace the delegations in the order `\"A\"` then `\"B\"` then `\"C\"` but in this particular CI run, go-tuf traced the delegations `\"B\"->\"C\"->\"A\"`.\n\nIn a subsequent CI run, this test case did not fail, but [another one did](https://github.com/theupdateframework/tuf-conformance/pull/115#issuecomment-2275640487).\n\n@jku has done a bit of debugging and believes that the returned map of `GetRolesForTarget` returns a map that causes this behavior:\n\nhttps://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580\n\nWe believe that this map should be an ordered list instead of a map.\n\n## Affected packages\n\n- `github.com/theupdateframework/go-tuf/v2 < 2.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/theupdateframework/go-tuf/v2 2.0.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}