CVE-2025-14764CWE-327

CVE-2025-14764

Medium · published December 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade Amazon S3 Encryption Client for Go to version 4.0 or later.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00108 · 1.1th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-12-18T02:15Z
References (3)
https://aws.amazon.com/security/security-bulletins/AWS-2025-032/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 17 DEC 20:20Z
    Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that…
    cvelistv5