{"id":"CVE-2024-47534","aliases":["GHSA-4f8r-qqr9-fq8j","GO-2024-3166"],"url":"https://o3.security/vulnerability/CVE-2024-47534","summary":"Incorrect delegation lookups can make go-tuf download the wrong artifact","details":"During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact. \n\nWe have come across this issue in the test in this PR: https://github.com/theupdateframework/tuf-conformance/pull/115.\n\nThe test - `test_graph_traversal` - sets up a repository with a series of delegations, invokes the clients `refresh()` and then checks the order in which the client traced the delegations. The test shows that the go-tuf client inconsistently traces the delegations in a wrong way. For example, [during one CI run](https://github.com/theupdateframework/tuf-conformance/pull/115#issuecomment-2275625542), the `two-level-delegations` test case triggered a wrong order. The delegations in this look as such:\n\n```python\n\"two-level-delegations\": DelegationsTestCase(\n        delegations=[\n            DelegationTester(\"targets\", \"A\"),\n            DelegationTester(\"targets\", \"B\"),\n            DelegationTester(\"B\", \"C\"),\n        ],\n        visited_order=[\"A\", \"B\", \"C\"],\n    ),\n```\n\nHere, `targets` delegate to `\"A\"`, and to `\"B\"`, and `\"B\"` delegates to `\"C\"`. The client should trace the delegations in the order `\"A\"` then `\"B\"` then `\"C\"` but in this particular CI run, go-tuf traced the delegations `\"B\"->\"C\"->\"A\"`.\n\nIn a subsequent CI run, this test case did not fail, but [another one did](https://github.com/theupdateframework/tuf-conformance/pull/115#issuecomment-2275640487).\n\n@jku has done a bit of debugging and believes that the returned map of `GetRolesForTarget` returns a map that causes this behavior:\n\nhttps://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580\n\nWe believe that this map should be an ordered list instead of a map.","published":"2024-10-01T15:17:47.363Z","modified":"2026-08-12T03:51:42.980966946Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/theupdateframework/go-tuf/v2","fixedVersion":"2.0.1"}],"fix":{"url":"https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d","label":"theupdateframework/go-tuf@edc30b4"},"references":[{"type":"WEB","url":"https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47534.json"},{"type":"ADVISORY","url":"https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47534"},{"type":"FIX","url":"https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d"},{"type":"FIX","url":"https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819"},{"type":"FIX","url":"https://github.com/theupdateframework/tuf-conformance/pull/115"},{"type":"PACKAGE","url":"https://github.com/theupdateframework/go-tuf"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-3166"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.980966946Z"}}