PT-2025-51884 · Amazon · Amazon S3 Encryption Client For Java

Antonf-Amzn · Publicado 2025-12-17 · Atualizado 2025-12-21 · CVE-2025-14763

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon S3 Encryption Client for Java versions prior to 4.0.0

Description A missing cryptographic key commitment in the Amazon S3 Encryption Client for Java could allow a user with write access to an S3 bucket to introduce a new Encryption Data Key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record.

Recommendations Upgrade Amazon S3 Encryption Client for Java to version 4.0.0 or later.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2025-14763

GHSA-X44P-GVRJ-PJ2R

Produtos afetados

Amazon S3 Encryption Client For Java

Referências · 9

• https://github.com/aws/amazon-s3-encryption-client-java/releases/tag/v4.0.0 · Correção
• https://github.com/aws/amazon-s3-encryption-client-java/security/advisories/GHSA-x44p-gvrj-pj2r · Nota
• https://github.com/aws/amazon-s3-encryption-client-java/commit/9d4523edbbc249781b3b3b3f8868fad39c5673d5 · Nota
• https://github.com/aws/amazon-s3-encryption-client-java · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14763 · Nota de Segurança
• https://aws.amazon.com/security/security-bulletins/AWS-2025-032 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2002835963937013984 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-14763 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x44p-gvrj-pj2r · Aviso do Fabricante