CVE-2022-29173

CVE-2022-29173 is a high-severity vulnerability in go-tuf, the Go implementation of The Update Framework, affecting versions prior to 0.3.0. The flaw lies in its incorrect implementation of the client workflow for updating non-root metadata files, specifically failing to properly prevent rollback attacks. This allows an attacker to trick clients into installing older, potentially vulnerable software versions. The vulnerability has a CVSS score of 8.8 (High) due to its network attack vector, low attack complexity, and high potential impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.