PT-2025-51883 · Amazon Web Services · Aws Sdk For Ruby

Normj · Publicado 2025-12-17 · Atualizado 2025-12-23 · CVE-2025-14762

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS SDK for Ruby versions prior to 1.208.0

Description A missing cryptographic key commitment in the AWS SDK for Ruby could allow a user with write access to an S3 bucket to introduce a new encryption data key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record.

Recommendations Upgrade AWS SDK for Ruby to version 1.208.0 or later.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2025-14762

GHSA-2XGQ-Q749-89FQ

Produtos afetados

Aws Sdk For Ruby

Referências · 15

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/aws-sdk-s3/CVE-2025-14762.yml · Exploit
• https://github.com/aws/aws-sdk-ruby · Nota
• https://github.com/aws/aws-sdk-ruby/commit/b633ba10cd2fbc4cc770b76ab531ed9647654044 · Nota
• https://github.com/aws/aws-sdk-ruby/security/advisories/GHSA-2xgq-q749-89fq · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14762 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1pt1cm5/resumen_diario_de_vulnerabilidades_22122025 · Publicação no Reddit
• https://cve.org/CVERecord?id=CVE-2025-14762 · Nota de Segurança
• https://twitter.com/CVEnew/status/2002835964893233415 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1pttxj6/resumen_diario_de_vulnerabilidades_23122025 · Publicação no Reddit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14762 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2xgq-q749-89fq · Aviso do Fabricante
• https://rubygems.org/gems/aws-sdk-s3/versions/1.208.0 · Correção
• https://osv.dev/vulnerability/CVE-2025-14762 · Aviso do Fabricante
• https://aws.amazon.com/security/security-bulletins/AWS-2025-032 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2025-14762 · Aviso do Fabricante