modules:
  - module: github.com/theupdateframework/go-tuf
    versions:
      - fixed: 0.3.0
    vulnerable_at: 0.2.0
    packages:
      - package: github.com/theupdateframework/go-tuf/client
        symbols:
          - Client.Update
          - Client.UpdateRoots
          - Client.downloadMetaFromSnapshot
          - Client.downloadMetaFromTimestamp
          - Client.decodeRoot
          - Client.decodeTargets
          - Client.decodeTimestamp
        derived_symbols:
          - Client.Download
          - Client.Init
          - Client.Target
      - package: github.com/theupdateframework/go-tuf/util
        symbols:
          - TimestampFileMetaEqual
description: |
    The TUF client is vulnerable to rollback attacks, in which an
    attacker causes a client to install software older than the software
    the client previously knew to be available.
published: 2022-07-01T20:07:44Z
cves:
  - CVE-2022-29173
ghsas:
  - GHSA-66x3-6cw3-v5gj
references:
  - fix: https://github.com/theupdateframework/go-tuf/commit/ed6788e710fc3093a7ecc2d078bf734c0f200d8d