Skip to content
Fencer Vulns
high 8.0

CVE-2022-29173 json

No protection against rollback attacks in go-tuf

published 2022-05-05 4 y ago modified 2026-06-17 4 mo ago also GHSA-66x3-6cw3-v5gj , GO-2022-0444 , EUVD-2022-2733

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software which the client previously knew to be available, and may include software with known vulnerabilities. In more detail, the client code of go-tuf has several issues in regards to preventing rollback attacks: 1. It does not take into account the content of any previously trusted metadata, if available, before proceeding with updating roles other than the root role (i.e., steps 5.4.3.1 and 5.5.5 of the detailed client workflow). This means that any form of version verification done on the newly-downloaded metadata is made using the default value of zero, which always passes. 2. For both timestamp and snapshot roles, go-tuf saves these metadata files as trusted before verifying if the version of the metafiles they refer to is correct (i.e., steps 5.5.4 and 5.6.4 of the detailed client workflow). A fix is available in version 0.3.0 or newer. No workarounds are known for this issue apart from upgrading.

Patch / fix

  • go github.com/theupdateframework/go-tuf 0.3.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-29173 updated cvss 8.0

go-tuf: No protection against rollback attacks for roles other than root

  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    affected: no fix available
  • Red Hat RHACS 3.71 for RHEL 8 advanced-cluster-security/rhacs-docs-rhel8 3.71.0-5, advanced-cluster-security/rhacs-main-rhel8 3.71.0-6, advanced-cluster-security/rhacs-roxctl-rhel8 3.71.0-5, advanced-cluster-security/rhacs-rhel8-operator 3.71.0-5
    fixed: vendor fix RHSA-2022:5704
  • Red Hat RHACS 3.71 for RHEL 8 advanced-cluster-security/rhacs-scanner-rhel8 3.71.0-5, advanced-cluster-security/rhacs-collector-rhel8 3.71.0-5, advanced-cluster-security/rhacs-operator-bundle 3.71.0-5, advanced-cluster-security/rhacs-scanner-db-rhel8 3.71.0-5, advanced-cluster-security/rhacs-scanner-slim-rhel8 3.71.0-5, advanced-cluster-security/rhacs-collector-slim-rhel8 3.71.0-2, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/theupdateframework/go-tuf
<0.3.0
0.3.0

Affected products

  • theupdateframework go-tuf

Classification

Weakness
  • CWE-354 Improper Validation of Integrity Check Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.