PT-2025-13410 · Tough · Tough

Adamkorcz + 1 · Published 2025-03-27 · Updated 2025-03-29 · CVE-2025-2887

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.20.0

Description The issue arises during a target rollback when the client fails to detect the rollback for delegated targets, potentially causing it to fetch a target from an incorrect source and alter the target contents. This could lead to the client trusting and downloading outdated targets that it should reject.

Recommendations For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Fix

Weakness Enumeration

CWE-1025

Related Identifiers

CVE-2025-2887

GHSA-Q6R9-R9PW-4CF7

Affected Products

Tough

References · 12

• https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 · Patch
• https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6r9-r9pw-4cf7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2887 · Security Note
• https://aws.amazon.com/security/security-bulletins/AWS-2025-007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2887 · Vendor Advisory
• https://github.com/awslabs/tough · Note
• https://github.com/awslabs/tough/commit/3345151a87c358d1ce43aeb7e8b3ebea5ebdbab4 · Note
• https://t.me/cvedetector/21344 · Telegram Post
• https://t.me/cvetracker/20119 · Telegram Post
• https://t.me/cvenotify/116646 · Telegram Post
• https://twitter.com/CVEnew/status/1905811745639141390 · Twitter Post