CVE-2022-29173: Version rollback attack in github.com/theupdateframework/go-tuf
Summary
CVE-2022-29173: Version rollback attack in github.com/theupdateframework/go-tuf. Affects github.com/theupdateframework/go-tuf versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/theupdateframework/go-tuf package is a Go implementation of The Update Framework (TUF), which is a security framework designed to secure software update systems. It provides a client library that allows users to securely download and install software updates. The vulnerability in this package allows for version rollback attacks, where an attacker can trick the client into installing older software versions than what it previously knew to be available.
Vulnerability Detail
The vulnerability in github.com/theupdateframework/go-tuf allows an attacker to manipulate the client's perception of available software updates, leading to the installation of older and potentially vulnerable software versions. This can be achieved by tampering with the metadata files used by the client to verify the authenticity and integrity of the updates. By exploiting this vulnerability, an attacker can bypass the security measures provided by TUF and potentially gain unauthorized access or execute malicious code on the client's system.
How To Fix
Latest published version: v0.7.0 as of 23 Oct 2026
go get github.com/theupdateframework/go-tuf@v0.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
go get github.com/theupdateframework/go-tuf@v0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to update to the fixed version of the package as soon as possible.
Conclusion
The version rollback attack vulnerability in github.com/theupdateframework/go-tuf can have serious security implications, allowing attackers to install older and potentially vulnerable software versions. Users are strongly advised to update to version 0.3.0 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/theupdateframework/go-tuf →
FAQ
The Update Framework (TUF) is a security framework designed to secure software update systems. It provides a set of specifications and libraries that enable secure software distribution and installation.
A version rollback attack is a type of attack where an attacker tricks a client into installing older software versions than what it previously knew to be available. This can be done by tampering with the metadata used by the client to verify the authenticity and integrity of the updates.
The version rollback attack vulnerability in github.com/theupdateframework/go-tuf can allow an attacker to install older and potentially vulnerable software versions on the client's system. This can lead to unauthorized access, data breaches, or the execution of malicious code.
There are no known exploits of this vulnerability at the moment. However, it is important to update to the fixed version of the package to mitigate the risk of potential attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/theupdateframework/go-tuf.
