Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-2888

During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Published

2025-03-27T23:15:35.717

Last Modified

2025-10-14T19:15:40.007

Status

Modified

Source

ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity

CVSSv3.1: 4.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-1025

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	amazon	tough	< 0.20.0	Yes

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ Vendor Advisory (ff89ba41-3aa1-4d27-914a-91399e9639e5)
https://github.com/awslabs/tough/releases/tag/tough-v0.20.0 (ff89ba41-3aa1-4d27-914a-91399e9639e5)
https://github.com/awslabs/tough/security/advisories/GHSA-76g3-38jv-wxh4 Vendor Advisory (ff89ba41-3aa1-4d27-914a-91399e9639e5)