id: GO-2022-1004
modules:
    - module: github.com/theupdateframework/go-tuf
      versions:
        - fixed: 0.3.2
      vulnerable_at: 0.3.1
      packages:
        - package: github.com/theupdateframework/go-tuf/verify
          symbols:
            - DB.VerifySignatures
          derived_symbols:
            - DB.Unmarshal
            - DB.UnmarshalIgnoreExpired
            - DB.UnmarshalTrusted
            - DB.Verify
            - DB.VerifyIgnoreExpiredCheck
summary: Improper handling of keys in github.com/theupdateframework/go-tuf
description: |-
    An attacker with the ability to insert public keys into a TUF repository can
    cause clients to accept a staged change that has not been signed by the correct
    threshold of signatures.
ghsas:
    - GHSA-3633-5h82-39pq
references:
    - advisory: https://github.com/advisories/GHSA-3633-5h82-39pq
    - fix: https://github.com/theupdateframework/go-tuf/pull/369