{"id":"CVE-2025-2887","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-2887","generatedAt":"2026-10-27T23:56:27.676Z","title":"During a target rollback, the client fails to detect the rollback for delegated targets.","description":"During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.","published":"2025-03-27T23:15:36.000Z","lastModified":"2026-06-17T09:07:48.000Z","status":"Modified","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","cvss":{"version":"4.0","score":5.7,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-1025"],"affected":["amazon/tough"],"epss":{"score":0.00332,"percentile":0.26245,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2025-007/","tags":["Vendor Advisory"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/awslabs/tough/releases/tag/tough-v0.20.0","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/awslabs/tough/security/advisories/GHSA-q6r9-r9pw-4cf7","tags":["Vendor Advisory"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-2887","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}