{"action":"Upgrade github.com/theupdateframework/go-tuf to 0.3.0 or later.","affected":[{"fixed":"0.3.0","introduced":"0"}],"component":"github.com/theupdateframework/go-tuf","cve_ids":["CVE-2022-29173"],"ecosystem":"Go","epss":0.0057,"exploited":false,"fixed_versions":["0.3.0"],"ghsa_id":"GHSA-66x3-6cw3-v5gj","id":"tcs_01M5KFVJZMJTVJTT7DS81PNMKZ","modified_at":"2024-05-20T16:03:47Z","published_at":"2022-07-01T20:07:44Z","references":["https://osv.dev/vulnerability/GO-2022-0444","https://github.com/theupdateframework/go-tuf/commit/ed6788e710fc3093a7ecc2d078bf734c0f200d8d"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2022-0444","url":"https://osv.dev/vulnerability/GO-2022-0444"}],"summary":"Version rollback attack in github.com/theupdateframework/go-tuf"}