Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

tough updates may stop after a snapshot rollback

CVE-2025-2888 · published 1 year ago
Summary

The tough software can get stuck after rolling back a snapshot because it saves the wrong time information. This prevents the next update from being applied until the saved data is cleared. Upgrade to tough version 0.20.0 or newer, and apply the same fix to any custom versions of the software.

What to do
  • Update iliana tough to version 0.20.0.
  • Update amazon tough to version 0.20.0 or later.
Affected software
Ecosystem VendorProductAffected versions
rust iliana tough < 0.20.0
Fix: upgrade to 0.20.0
– amazon tough < 0.20.0
cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*
Original advisory text
Improper timestamp caching during snapshot rollback in tough
During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1025Comparison Using Wrong Factors
Timeline
Published27 Mar 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-76g3-38jv-wxh4 · GHSA
CVE-2025-2888 · NVD
CVE-2025-2888 · OSV
Track software like this
Free during beta