[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fITvpAwwuf2u2A-gaotFU1oNTdMToPcTK-ByJdRcWBqk":3,"g5a-risk:CVE-2025-2885":107},{"success":4,"data":5,"meta":104},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":33,"epssPercentile":28,"epssTimeSeries":34,"severity":35,"affectedProducts":36,"affectedProductsCount":42,"references":43,"referencesCount":56,"weaknesses":57,"weaknessesCount":42,"isActivelyExploited":66,"cisaInfo":28,"otxData":28,"relatedBlogPosts":67,"seoMetadata":68,"configurations":93,"relatedVendorCves":102,"notableEvents":103},"CVE-2025-2885","What is CVE-2025-2885?","Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.","Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended vers...","2025-03-27T23:15:35.24","2025-10-14T19:15:39.25",4.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":31,"CVSSMetricV2":32,"CVSSMetricV40":28},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":23,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","NETWORK","LOW","HIGH","REQUIRED","UNCHANGED","NONE","MEDIUM",null,0.9,3.6,[],[],0.00332,[33,33,33,33,33,33,33],"Medium",[37],{"vendor":38,"product":39,"version":40,"criteria":41,"vulnerable":4},"amazon","tough","*","cpe:2.3:a:amazon:tough:*:*:*:*:*:rust:*:*",1,[44,49,53],{"url":45,"source":46,"tags":47},"https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fsecurity-bulletins\u002FAWS-2025-007\u002F","Amazon",[48],"Vendor Advisory",{"url":50,"source":51,"tags":52},"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Ftough\u002Freleases\u002Ftag\u002Ftough-v0.20.0","GitHub",[],{"url":54,"source":51,"tags":55},"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Ftough\u002Fsecurity\u002Fadvisories\u002FGHSA-5vmp-m5v2-hx47",[48],3,[58],{"id":59,"name":60,"description":61,"extendedDescription":62,"status":63,"abstraction":64,"structure":65},"CWE-1288","Improper Validation of Consistency within Input","The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.","Some input data can be structured with multiple elements or fields that must be consistent with each other, e.g. a number-of-items field that is followed by the expected number of elements.  When such complex inputs are inconsistent, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities.","Incomplete","Base","Simple",false,[],{"title":69,"metaDescription":70,"keywords":71,"canonicalUrl":72,"structuredData":73},"What is CVE-2025-2885? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2025-2885, a medium severity cyber security vulnerability from 2025. Missing validation of the root metatdata version number co...","CVE-2025-2885, CVE-2025-2885 vulnerability, CVE-2025-2885 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2025, CVSS score, exploit, patch, remediation, amazon security, tough vulnerability","\u002Fwhat-is\u002Fcve-2025-2885",{"@context":74,"@type":75,"headline":69,"description":70,"datePublished":10,"dateModified":11,"author":76,"publisher":80,"about":84,"mainEntityOfPage":88,"articleSection":91,"keywords":92},"https:\u002F\u002Fschema.org","TechArticle",{"@type":77,"name":78,"url":79},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":77,"name":78,"url":79,"logo":81},{"@type":82,"url":83},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":85,"name":6,"description":86,"additionalType":87},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":89,"@id":90},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2025-2885","Cybersecurity","CVE-2025-2885, CVE-2025-2885 vulnerability, CVE-2025-2885 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[94],{"Operator":28,"Negate":28,"Nodes":95},[96],{"Operator":97,"Negate":66,"CPEMatch":98},"OR",[99],{"Vulnerable":4,"Criteria":41,"MatchCriteriaID":100,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":101,"VersionEndIncluding":28},"E16D23E6-5B9B-4ADF-AD1E-FD483707F5C1","0.20.0",[],[],{"lastModified":11,"cacheTime":105,"version":106},1793223533401,"2.0",{"score":108,"band":109,"action":110,"scoredAt":111},17,"Info","Track","2026-10-28T07:07:12.755487+00:00"]