CVE-2025-14761CWE-327

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to…

Medium · published December 17, 2025

CVSS v4.0
6.0
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade AWS SDK for PHP to version 3.368.0 or later

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-12-17T20:13Z
EPSS history
Timeline
  • 17 DEC 20:13Z
    Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to…
    cvelistv5