modules:
  - module: github.com/theupdateframework/go-tuf
    versions:
      - fixed: 0.3.2
    vulnerable_at: 0.3.1
    packages:
      - package: github.com/theupdateframework/go-tuf/verify
        symbols:
          - DB.VerifySignatures
        derived_symbols:
          - DB.Unmarshal
          - DB.UnmarshalIgnoreExpired
          - DB.UnmarshalTrusted
          - DB.Verify
          - DB.VerifyIgnoreExpiredCheck
description: |
    An attacker with the ability to insert public keys into a TUF
    repository can cause clients to accept a staged change that has
    not been signed by the correct threshold of signatures.
ghsas:
  - GHSA-3633-5h82-39pq
references:
  - advisory: https://github.com/advisories/GHSA-3633-5h82-39pq
  - fix: https://github.com/theupdateframework/go-tuf/pull/369