VDB
CVE-2025-2887
CVE-2025-2887
PUBLISHED
CVSS 5.699999809265137 MEDIUM
During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
EPSS 0.33% · 23.7th percentile
Risk Scores
CVSS 4.0
5.699999809265137
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.33%
23.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AWS | tough | 0.1.0 |
| amazon | tough | 0 |
| crates.io | tough | 0 |
Timeline
- Mar 27, 2025 CVE Published
- Mar 28, 2025 EPSS Score
- Mar 28, 2025 Coalition ESS Score
- Apr 11, 2025 EPSS Score
- Apr 24, 2025 EPSS Score
- May 8, 2025 EPSS Score
- May 21, 2025 EPSS Score
- Jun 4, 2025 EPSS Score
- Jun 18, 2025 EPSS Score
- Jul 1, 2025 EPSS Score
- Jul 11, 2025 Coalition ESS Score
- Jul 15, 2025 EPSS Score
References
- https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 fix
- https://github.com/awslabs/tough/commit/3345151a87c358d1ce43aeb7e8b3ebea5ebdbab4 fix
- https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7 vendor-advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-2887 advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2025-007 url
- https://github.com/awslabs/tough package