Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-2885

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Published

2025-03-27T23:15:35.240

Last Modified

2025-10-14T19:15:39.250

Status

Modified

Source

ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity

CVSSv3.1: 4.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-1288
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application amazon tough < 0.20.0 Yes
References