SB2025032830 - Multiple vulnerabilities in tough

Main Vulnerability Database SB2025032830

SB2025032830 - Multiple vulnerabilities in tough

Published: March 28, 2025

Security Bulletin ID SB2025032830

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 5

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 5 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2025-2885)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to the root metadata version is not checked for sequential versioning. A remote administrator can cause the target system to trust content associated with a previous root role.

2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to cyclic delegation graphs are not detected. A remote administrator can cause the exhausted call stack to cause the process to abort.

3) Comparison using wrong factors (CVE-ID: CVE-2025-2887)

CWE-ID: CWE-1025 - Comparison using wrong factors

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to failure to detect delegated target rollback. A remote administrator can cause the affected software to trust and download outdated targets that it should reject.

4) Comparison using wrong factors (CVE-ID: CVE-2025-2888)

CWE-ID: CWE-1025 - Comparison using wrong factors

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to timestamp metadata is cached when it fails snapshot rollback check. A remote administrator can cause the affected software to subsequently incorrectly identify valid timestamp metadata as being rolled back, preventing the client from consuming valid updates.

5) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2025-2886)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to terminating targets role delegations are not respected. A remote administrator can provide arbitrary contents to clients for targets owned by the delegating identity.

Remediation

Install update from vendor's website.

References