Log in Start free

Vulnerability · Published Dec 17, 2025 · Assigned by AMZN

CVE-2025-14762

Medium 5.3

In plain English

A medium-severity broken cryptography in AWS SDK for Ruby from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsaws-sdk-s31.208.0GHSA-2xgq-q749-89fq
Ubuntu:22.04:LTSruby-aws-sdkno fix listedUBUNTU-CVE-2025-14762
Ubuntu:24.04:LTSruby-aws-sdkno fix listedUBUNTU-CVE-2025-14762
Ubuntu:25.10ruby-aws-sdkno fix listedUBUNTU-CVE-2025-14762
Ubuntu:26.04:LTSruby-aws-sdkno fix listedUBUNTU-CVE-2025-14762
Ubuntu:26.10ruby-aws-sdkno fix listedUBUNTU-CVE-2025-14762

Affected products (as reported)

VendorProductVersions
AWS AWS SDK for Ruby see references

Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

References