Количество 8
Количество 8
GHSA-fphv-w9fq-2525
go-tuf improperly validates the configured threshold for delegations
CVE-2026-23992
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
CVE-2026-23992
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
CVE-2026-23992
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
CVE-2026-23992
go-tuf is a Go implementation of The Update Framework (TUF). Starting ...
BDU:2026-01059
Уязвимость функции metadata.VerifyDelegate() фреймворка для обеспечения безопасности систем обновления программного обеспечения go-tuf, позволяющая нарушителю получить доступ на чтение и изменение данных
openSUSE-SU-2026:20386-1
Security update for cosign
SUSE-SU-2026:0777-1
Security update for cosign
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-fphv-w9fq-2525 go-tuf improperly validates the configured threshold for delegations | CVSS3: 5.9 | 0% Низкий | 7 месяцев назад |
 | CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1. | CVSS3: 5.9 | 0% Низкий | 7 месяцев назад |
 | CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1. | CVSS3: 5.9 | 0% Низкий | 7 месяцев назад |
 | CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1. | CVSS3: 5.9 | 0% Низкий | 7 месяцев назад |
| CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Starting ... | CVSS3: 5.9 | 0% Низкий | 7 месяцев назад |
 | BDU:2026-01059 Уязвимость функции metadata.VerifyDelegate() фреймворка для обеспечения безопасности систем обновления программного обеспечения go-tuf, позволяющая нарушителю получить доступ на чтение и изменение данных | CVSS3: 5.9 | 0% Низкий | 7 месяцев назад |
 | openSUSE-SU-2026:20386-1 Security update for cosign | 5 месяцев назад | ||
| SUSE-SU-2026:0777-1 Security update for cosign | 6 месяцев назад |
Уязвимостей на страницу