Medium severity · published Mar 27, 2025
CVE-2025-2888
Improper timestamp caching during snapshot rollback in tough
4.5
CVSS
0.3%
EPSS
No
On KEV
Description
During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
tough · AWS
0.1.0 before 0.20.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2888
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
github.com
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
Vendor Advisory
https://github.com/awslabs/tough/security/advisories/GHSA-76g3-38jv-wxh4
More from tough
6.5
CVE-2026-6968
Multiple Path Traversal Variants in awslabs/tough
6.5
CVE-2026-6967
Missing Delegated Metadata Validation in awslabs/tough
6.5
CVE-2026-6966
Signature Threshold Bypass in awslabs/tough Delegated Roles
4.5
CVE-2025-2887
Failure to detect delegated target rollback in tough
4.5
CVE-2025-2886
Terminating targets role delegations are not respected in tough