CVE-2025-2885 json
Root metadata version not validated in tough
published last yr. modified 4mo ago also GHSA-5vmp-m5v2-hx47 , EUVD-2025-8666
- cvss
- 4.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Patch / fix
- crates.io tough 0.20.0
- AWS tough 0.20.0
Is CVE-2025-2885 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 4.2 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | tough | <0.20.0 |
0.20.0 |
Affected products
- AWS tough
Classification
- Weakness
-
- CWE-1288 Improper Validation of Consistency within Input
References
-
github.com
/awslabs/tough/releases/tag/tough-v0.20.0
patch, web
-
github.com
/awslabs/tough/commit/0eeb60aefe27f00b65730634b788a1aafb8bf3c6
web
-
github.com
/awslabs/tough/security/advisories/GHSA-5vmp-m5v2-hx47
vendor-advisory, web
-
aws.amazon.com
/security/security-bulletins/AWS-2025-007/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-2885
advisory
-
aws.amazon.com
/security/security-bulletins/AWS-2025-007
web
-
github.com
/awslabs/tough
package
Sources
- CVE List CVE-2025-2885
- GitHub Advisory GHSA-5vmp-m5v2-hx47
- NVD CVE-2025-2885
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.