Improper validation of integrity check value in Go implementation of The Update Framework (TUF) - CVE-2022-29173
Published: July 26, 2022
Vulnerability identifier: #VU65785
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-29173
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass expected security restrictions.
The vulnerability exists due to incorrect implementation of the client workflow for updating the metadata files for roles other than the root role. Checks for rollback attacks are not implemented correctly, as a result a remote attacker can force clients to install older versions of software that may contain security vulnerabilities.
Affected software
Go implementation of The Update Framework (TUF)
Red Hat Advanced Cluster Security for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
How to mitigate CVE-2022-29173
Install updates from vendor's website.
Go implementation of The Update Framework (TUF) - update to 0.3.0
Red Hat Advanced Cluster Security for Kubernetes - update to 3.71
Red Hat Advanced Cluster Security for Kubernetes - update to 3.71