Medium severity · published Mar 27, 2025
CVE-2025-2887
During a target rollback, the client fails to detect the rollback for delegated targets
4.5
CVSS
0.3%
EPSS
No
On KEV
Description
During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tough · Amazon
before 0.20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2887
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
github.com
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
Vendor Advisory
https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7
More from Tough
8.6
CVE-2020-15093
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures
8.1
CVE-2021-41149
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories
6.5
CVE-2026-6968
Multiple Path Traversal Variants in awslabs/tough
6.5
CVE-2026-6967
Missing Delegated Metadata Validation in awslabs/tough
6.5
CVE-2026-6966
Signature Threshold Bypass in awslabs/tough Delegated Roles