PT-2025-13406 · Tough · Tough

Adamkorcz + 1 · Published 2025-03-27 · Updated 2025-03-29 · CVE-2025-2885

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.20.0

Description The issue arises from missing validation of the root metadata version number, allowing an actor to supply an arbitrary version number to the client. This could lead to the client trusting an outdated or rotated root role, potentially trusting content associated with a previous root role. Users should upgrade to a version that incorporates the new fixes to prevent this issue.

Recommendations For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Fix

Weakness Enumeration

CWE-1288

Related Identifiers

CVE-2025-2885

GHSA-5VMP-M5V2-HX47

Affected Products

Tough

References · 12

• https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 · Patch
• https://github.com/awslabs/tough/security/advisories/GHSA-5vmp-m5v2-hx47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2885 · Security Note
• https://aws.amazon.com/security/security-bulletins/AWS-2025-007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2885 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5vmp-m5v2-hx47 · Vendor Advisory
• https://github.com/awslabs/tough · Note
• https://github.com/awslabs/tough/commit/0eeb60aefe27f00b65730634b788a1aafb8bf3c6 · Note
• https://t.me/cvetracker/20117 · Telegram Post
• https://t.me/cvedetector/21340 · Telegram Post
• https://twitter.com/CVEnew/status/1905811747383947478 · Twitter Post
• https://t.me/cvenotify/116644 · Telegram Post