{"action":"Upgrade tough to 0.20.0 or later.","affected":[{"fixed":"0.20.0","introduced":"0"}],"component":"tough","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.20.0"],"ghsa_id":"GHSA-j8x2-777p-23fc","id":"tcs_01M5KF0ZK8VVPJ2HG3ARG1NK4J","modified_at":"2025-04-02T23:02:55Z","published_at":"2025-03-28T22:13:16Z","references":["https://osv.dev/vulnerability/GHSA-j8x2-777p-23fc","https://github.com/awslabs/tough/security/advisories/GHSA-j8x2-777p-23fc","https://github.com/awslabs/tough/commit/c5ee1718e630fdedc5676bf71b5bef10e4c7f91c","https://aws.amazon.com/security/security-bulletins/AWS-2025-007","https://github.com/awslabs/tough"],"severity":{"label":"low","score":2.7},"sources":[{"source":"osv","source_id":"GHSA-j8x2-777p-23fc","url":"https://osv.dev/vulnerability/GHSA-j8x2-777p-23fc"}],"summary":"tough cyclic delegation graphs are not detected"}