Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Fri, 28 Mar 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 27 Mar 2025 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When updating the root role, a TUF client must establish a trusted line of continuity to the latest set of keys. While sequentially downloading new versions of the root metadata file, tough will not check that the root object version it received was the next sequential version from the previously trusted root metadata. As a result, tough could trust content associated with a previous root role. The tough client will trust an unexpected root role in the event that an actor with control of the storage medium of a trusted TUF repository inappropriately replaced the contents of one of the root metadata files with an adequately signed previous version. As a result, tough could trust content associated with a previous root role. | Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes. |
| Title | Root metadata version not validated in awslabs/tough | Root metadata version not validated in tough |
Thu, 27 Mar 2025 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When updating the root role, a TUF client must establish a trusted line of continuity to the latest set of keys. While sequentially downloading new versions of the root metadata file, tough will not check that the root object version it received was the next sequential version from the previously trusted root metadata. As a result, tough could trust content associated with a previous root role. The tough client will trust an unexpected root role in the event that an actor with control of the storage medium of a trusted TUF repository inappropriately replaced the contents of one of the root metadata files with an adequately signed previous version. As a result, tough could trust content associated with a previous root role. | |
| Title | Root metadata version not validated in awslabs/tough | |
| Weaknesses | CWE-1288 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2025-03-28T15:47:35.890Z
Reserved: 2025-03-27T21:08:13.996Z
Link: CVE-2025-2885
Vulnrichment
Updated: 2025-03-28T15:47:29.640Z
NVD
Status : Awaiting Analysis
Published: 2025-03-27T23:15:35.240
Modified: 2025-03-28T18:11:40.180
Link: CVE-2025-2885
Redhat
No data.