CVE-2025-2887CWE-1025

Failure to detect delegated target rollback in tough

Medium · published March 27, 2025

CVSS v4.0
5.7
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-1025 · Comparison Using Wrong Factors
Published
2025-03-27T22:23Z
EPSS history
Timeline
  • 27 MAR 22:23Z
    Failure to detect delegated target rollback in tough
    cvelistv5