CVE-2025-14762CWE-327

CVE-2025-14762

Medium · published December 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.2th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-12-18T02:15Z
References (3)
https://aws.amazon.com/security/security-bulletins/AWS-2025-032/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/aws-sdk-ruby/security/advisories/GHSA-2xgq-q749-89fq · ff89ba41-3aa1-4d27-914a-91399e9639e5https://rubygems.org/gems/aws-sdk-s3/versions/1.208.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 17 DEC 20:15Z
    Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to…
    cvelistv5