CVE-2022-1004: Improper handling of keys in go-tuf
Summary
GO-2022-1004: Improper handling of keys in github.com/theupdateframework/go-tuf. Affects github.com/theupdateframework/go-tuf versions < 0.3.2. Fixed in 0.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The go-tuf package is a Go implementation of The Update Framework (TUF), which is a security framework for software update systems. It provides a secure way to distribute and update software packages. The package includes functions for verifying signatures and unmarshaling data from a TUF repository. However, a vulnerability has been discovered in the way go-tuf handles keys in the repository.
Vulnerability Detail
The vulnerability (CVE-2022-1004) arises from improper handling of keys in the go-tuf package. An attacker who can insert public keys into a TUF repository can manipulate clients into accepting a staged change that has not been signed by the correct threshold of signatures. This can lead to unauthorized and potentially malicious updates being installed on client systems.
How To Fix
Latest published version: v0.7.0 as of 23 Oct 2026
go get github.com/theupdateframework/go-tuf@v0.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.2
This is the first release that contains the fix.
go get github.com/theupdateframework/go-tuf@v0.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the go-tuf package as soon as possible.
Conclusion
In conclusion, the go-tuf package is vulnerable to an improper handling of keys issue that allows attackers to insert unauthorized updates into TUF repositories. To mitigate this vulnerability, users should update to version 0.3.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/theupdateframework/go-tuf →
FAQ
Go-tuf is a Go implementation of The Update Framework (TUF), a security framework for software update systems.
This vulnerability allows an attacker to insert unauthorized and potentially malicious updates into a TUF repository, which can then be installed on client systems.
To fix this vulnerability, update your go-tuf package to version 0.3.2 or later.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the go-tuf package.
For more information, you can visit the vulnerability database at https://pkg.go.dev/vuln/GO-2022-1004.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/theupdateframework/go-tuf.
