go-tuf Denial-of-Service Vulnerability via Malformed TUF Metadata

A denial-of-service vulnerability has been identified in go-tuf, a Go implementation of The Update Framework (TUF). This issue affects versions 2.0.0 prior to 2.3.1. The vulnerability arises when a TUF repository or its mirrors return invalid TUF metadata JSON. While the JSON may be valid, it does not conform to the expected TUF metadata structure. When the client attempts to parse this malformed data, it panics, leading to a crash. Notably, this panic occurs before any signature validation, allowing a compromised repository, mirror, or cache to disrupt client operations without needing access to signing keys.

Impact

Exploiting this vulnerability causes the client to crash while parsing TUF metadata, potentially leading to a restart or crash loop in long-running services.

Remediation

Users can upgrade to version 2.3.1 or later to address this vulnerability.