CVE-2025-2886

Katalog CVE

CVSS 4.5 · Medium EPSS 0,33%

Kerentanan Always-Incorrect Control Flow Implementation pada amazon tough. Skor CVSS 3.1 4.5 (Medium) menurut NVD.

Deskripsi (NVD)

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Rincian

Terbit di NVD

27 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/AWS-2025-007/ advisory vendor
• https://github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc advisory vendor
• https://github.com/awslabs/tough/releases/tag/tough-v0.20.0