CVE-2024-47534

What it actually does

The go-tuf client processes delegation chains in an inconsistent order, allowing a chain such as A then B then C to be evaluated as B then C then A and thereby violating intended delegation constraints.

Why it matters to the business

Organizations relying on TUF-protected software updates risk accepting unauthorized or tampered artifacts, which can undermine the integrity of their software supply chain and increase exposure to downstream compromise.

How an attack unfolds

An attacker publishes a malicious TUF repository containing carefully ordered delegations that trigger the client's ordering bug, causing the client to skip required verification steps and accept an update that should have been rejected.

How to fix it

Upgrade theupdateframework/go-tuf to commit 6c47391ef3da3eac29e7b019da00e072303bd748 or later (equivalent to release 2.0.1). For the XWiki livedata-macro component, upgrade to 13.10.10, 14.4.7, or 14.9 as appropriate.

How to confirm the fix worked

Inventory all direct and transitive uses of go-tuf, confirm the resolved version meets or exceeds the fixed release, and run the project's test suite with delegation-chain test cases to verify correct ordering behavior.

Typical attack path

1. Locate an application or build system that consumes updates via the vulnerable go-tuf client
2. Host a malicious TUF repository that uses a delegation topology exploiting the ordering inconsistency
3. Serve a crafted update whose metadata bypasses intended delegation checks
4. Induce the target client to fetch and validate the update, resulting in acceptance of the malicious artifact

How to detect it

Review update-client logs for delegation-processing sequences, compare observed delegation order against expected repository metadata, and correlate any anomalous acceptances of updates with client version information.

What your security team should do

• Treat the dependency upgrade as a high-priority supply-chain hardening task
• Add go-tuf to automated dependency scanning with a minimum-version policy
• Review internal update pipelines that rely on TUF to ensure delegation rules remain effective after the upgrade