PT-2025-13411 · Tough · Tough

Adamkorcz + 1 · Published 2025-03-27 · Updated 2025-03-29 · CVE-2025-2888

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.20.0

Description The issue arises during a snapshot rollback when the client incorrectly caches the timestamp metadata. This leads to a failure in update timestamp validation, preventing further updates until the cache is cleared. The problem occurs because the client will persist invalid timestamp metadata to its cache, which may then cause it to incorrectly identify valid timestamp metadata as being rolled back. This prevents the client from consuming valid updates.

Recommendations For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Fix

Weakness Enumeration

CWE-1025

Related Identifiers

CVE-2025-2888

GHSA-76G3-38JV-WXH4

Affected Products

Tough

References · 11

• https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 · Patch
• https://github.com/awslabs/tough/security/advisories/GHSA-76g3-38jv-wxh4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-76g3-38jv-wxh4 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2025-007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2888 · Security Note
• https://github.com/awslabs/tough · Note
• https://github.com/awslabs/tough/commit/9b400e1c8b7d6b9ab8009104fa7fe5884db05f18 · Note
• https://t.me/cvedetector/21345 · Telegram Post
• https://twitter.com/CVEnew/status/1905811744691228926 · Twitter Post
• https://t.me/cvetracker/20120 · Telegram Post