SecuriTricks - CVE-2025-2885

Description

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Product(s) Impacted

Vendor	Product	Versions
Tough	Tough	>=0.20.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1288

Improper Validation of Consistency within Input

The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	tough	tough	>=0.20.0	/	/	/	/	/	/	/

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-007/

https://github.com/awslabs/tough/security/advisories/GHSA-5vmp-m5v2-hx47

CVSS Score

5.7 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: HIGH
Attack Requirements: NONE
Privileges Required: HIGH
User Interaction: PASSIVE
Scope:
Confidentiality Impact: NONE
Integrity Impact: HIGH
Availability Impact: NONE
Exploit Maturity: NOT_DEFINED

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: March 27, 2025, 11:15 p.m.
Last Modified: March 28, 2025, 6:11 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

ff89ba41-3aa1-4d27-914a-91399e9639e5

CVE-2025-2885