GHSA-5vmp-m5v2-hx47
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5vmp-m5v2-hx47
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-5vmp-m5v2-hx47/GHSA-5vmp-m5v2-hx47.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5vmp-m5v2-hx47
- Aliases
-
- CVE-2025-2885
- Published
- 2025-03-28T22:12:36Z
- Modified
- 2025-03-28T22:36:39.520067Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- tough root metadata version is not checked for sequential versioning
- Details
-
Summary
When updating the root role, a TUF client must establish a trusted line of continuity to the latest set of keys. While sequentially downloading new versions of the root metadata file, tough will not check that the root object version it received was the next sequential version from the previously trusted root metadata.
Impact
The tough client will trust an outdated or rotated root role in the event that an actor with control of the storage medium of a trusted TUF repository inappropriately replaced the contents of one of the root metadata files with an adequately signed previous version. As a result, tough could trust content associated with a previous root role.
Impacted versions: < v0.20.0
Patches
A fix for this issue is available in tough version 0.20.0 and later. Customers are advised to upgrade to version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Workarounds
There is no recommended work around. Customers are advised to upgrade to version 0.20.0 or the latest version.
References
If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting
Acknowledgement
We would like to thank Google for collaborating on this issue through the coordinated vulnerability disclosure process.
- Database specific
{ "nvd_published_at": "2025-03-27T23:15:35Z", "cwe_ids": [ "CWE-1288" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-03-28T22:12:36Z" }- References
Affected packages
crates.io / tough
Package
- Name
- tough
- View open source insights on deps.dev
- Purl
- pkg:cargo/tough