{"id":"CVE-2025-2888","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-2888","generatedAt":"2026-10-28T04:32:57.543Z","title":"During a snapshot rollback, the client incorrectly caches the timestamp metadata.","description":"During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.","published":"2025-03-27T23:15:36.000Z","lastModified":"2026-06-17T09:07:48.000Z","status":"Modified","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","cvss":{"version":"4.0","score":5.7,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-1025"],"affected":["amazon/tough"],"epss":{"score":0.00332,"percentile":0.26304,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2025-007/","tags":["Vendor Advisory"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/awslabs/tough/releases/tag/tough-v0.20.0","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/awslabs/tough/security/advisories/GHSA-76g3-38jv-wxh4","tags":["Vendor Advisory"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-2888","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}