CVE-2025-2885: Root metadata version not validated in tough

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-27 · updated 2026-06-17
Weakness: CWE-1288

Description

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

AWS tough: before 0.20.0 — fixed in 0.20.0

How to fix

Upgrade to a fixed version: AWS tough 0.20.0. Check the vendor advisory for mitigations.

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
https://github.com/awslabs/tough/security/advisories/GHSA-5vmp-m5v2-hx47

Get alerted when CVE-2025-2885 or the next vulnerability affects your stack