github.com/theupdateframework/go-tuf/v2
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names | github.com/theupdateframework/go-tuf/v2OpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 | GoRed Hat | Medium | Fix reported | |
| go-tuf improperly validates the configured threshold for delegations | github.com/theupdateframework/go-tuf/v2OpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 | GoRed Hat | Medium | Fix reported | |
| go-tuf affected by client DoS via malformed server response | github.com/theupdateframework/go-tuf/v2OpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 | GoRed Hat | Medium | Fix reported | |
| Incorrect delegation lookups can make go-tuf download the wrong artifact | github.com/theupdateframework/go-tuf/v2 | Go | High | Fix reported |