Medium severity · published Mar 27, 2025
CVE-2025-2887
Failure to detect delegated target rollback in tough
4.5
CVSS
0.3%
EPSS
No
On KEV
Description
During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
tough · AWS
0.1.0 before 0.20.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2887
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
github.com
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
Vendor Advisory
https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7
More from tough
6.5
CVE-2026-6968
Multiple Path Traversal Variants in awslabs/tough
6.5
CVE-2026-6967
Missing Delegated Metadata Validation in awslabs/tough
6.5
CVE-2026-6966
Signature Threshold Bypass in awslabs/tough Delegated Roles
4.5
CVE-2025-2888
Improper timestamp caching during snapshot rollback in tough
4.5
CVE-2025-2886
Terminating targets role delegations are not respected in tough