{"action":"Upgrade tough to 0.20.0 or later.","affected":[{"fixed":"0.20.0","introduced":"0"}],"component":"tough","cve_ids":["CVE-2025-2888"],"ecosystem":"crates.io","epss":0.00332,"exploited":false,"fixed_versions":["0.20.0"],"ghsa_id":"GHSA-76g3-38jv-wxh4","id":"tcs_01M5KEV1V7G7T8HKR727Q819RW","modified_at":"2025-10-14T21:59:01Z","published_at":"2025-03-28T14:49:47Z","references":["https://osv.dev/vulnerability/GHSA-76g3-38jv-wxh4","https://github.com/awslabs/tough/security/advisories/GHSA-76g3-38jv-wxh4","https://nvd.nist.gov/vuln/detail/CVE-2025-2888","https://github.com/awslabs/tough/commit/9b400e1c8b7d6b9ab8009104fa7fe5884db05f18","https://aws.amazon.com/security/security-bulletins/AWS-2025-007","https://github.com/awslabs/tough","https://github.com/awslabs/tough/releases/tag/tough-v0.20.0"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-76g3-38jv-wxh4","url":"https://osv.dev/vulnerability/GHSA-76g3-38jv-wxh4"}],"summary":"tough timestamp metadata is cached when it fails snapshot rollback check"}