CVE-2026-23992
Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
5.9
MEDIUM
CVSS 3.1
EPSS 0.20%
描述
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
如何修補 CVE-2026-23992
要修補 CVE-2026-23992,請將受影響套件升級到下列已修補版本。
- —未列出修補版本
- —升級至 2.3.1 或更新版本
- —升級至 2.3.1 或更新版本
CVE-2026-23992 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0
- from 0, < 2.3.1
- from 0, < 2.3.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |