Medium severity · published Mar 27, 2025
CVE-2025-2885
Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root…
4.5
CVSS
0.3%
EPSS
No
On KEV
Description
Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tough · Amazon
before 0.20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2885
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
github.com
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
Vendor Advisory
https://github.com/awslabs/tough/security/advisories/GHSA-5vmp-m5v2-hx47
More from Tough
8.6
CVE-2020-15093
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures
8.1
CVE-2021-41149
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories
6.5
CVE-2026-6968
Multiple Path Traversal Variants in awslabs/tough
6.5
CVE-2026-6967
Missing Delegated Metadata Validation in awslabs/tough
6.5
CVE-2026-6966
Signature Threshold Bypass in awslabs/tough Delegated Roles