VDB
CVE-2025-2887
CVE-2025-2887
PUBLISHED
CVSS 5.699999809265137 MEDIUM
During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
EPSS 0.25% · 48.1th percentile
Risk Scores
CVSS 4.0
5.699999809265137
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.25%
48.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AWS | tough | 0.1.0 |
| amazon | tough | 0 |
| crates.io | tough | 0 |
Exploit Intelligence
Timeline
- Mar 27, 2025 CVE Published
- Mar 28, 2025 EPSS Score
- Mar 28, 2025 Coalition ESS Score
- Apr 10, 2025 EPSS Score
- Apr 23, 2025 EPSS Score
- May 6, 2025 EPSS Score
- May 19, 2025 EPSS Score
- Jun 1, 2025 EPSS Score
- Jun 14, 2025 EPSS Score
- Jun 27, 2025 EPSS Score
- Jul 10, 2025 EPSS Score
- Jul 11, 2025 Coalition ESS Score
References
- https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7 vendor-advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ vendor-advisory
- https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 patch
- https://nvd.nist.gov/vuln/detail/CVE-2025-2887 advisory
- https://github.com/awslabs/tough/commit/3345151a87c358d1ce43aeb7e8b3ebea5ebdbab4 url
- https://aws.amazon.com/security/security-bulletins/AWS-2025-007 url
- https://github.com/awslabs/tough package