Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-14762

Good to know:

icon
icon

Date: December 17, 2025

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.

Severity Score

Related Resources (9)

https://aws.amazon.com/security/security-bulletins/AWS-2025-032/
https://nvd.nist.gov/vuln/detail/CVE-2025-14762
https://rubygems.org/gems/aws-sdk-s3/versions/1.208.0
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/aws-sdk-s3/CVE-2025-14762.yml
https://github.com/aws/aws-sdk-ruby/commit/b633ba10cd2fbc4cc770b76ab531ed9647654044
https://github.com/aws/aws-sdk-ruby
https://github.com/aws/aws-sdk-ruby/security/advisories/GHSA-2xgq-q749-89fq
https://aws.amazon.com/security/security-bulletins/AWS-2025-032
https://www.mend.io/vulnerability-database/CVE-2025-14762

Severity Score

Weakness Type (CWE)

Use of a Broken or Risky Cryptographic Algorithm

CWE-327

Top Fix

icon

Upgrade Version

Upgrade to version aws-sdk-s3 - 1.208.0;aws-sdk-s3 - 1.208.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us