PT-2025-46181 · Amazon Web Services · Aws Nodejs Wrapper+4

Published 2025-11-10 · Updated 2025-11-14 · CVE-2025-12967

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS JDBC Wrapper versions prior to 2.6.5 AWS Go Wrapper versions prior to 2025-10-17 AWS NodeJS Wrapper versions prior to 2.0.1 AWS Python Wrapper versions prior to 1.4.0 AWS PGSQL ODBC driver versions prior to 1.0.1

Description An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to the rds superuser role. An authenticated user with low privileges can create a crafted function that could be executed with the permissions of other Amazon Relational Database Service (RDS) users.

Recommendations Upgrade AWS JDBC Wrapper to version 2.6.5. Upgrade AWS Go Wrapper to version 2025-10-17. Upgrade AWS NodeJS Wrapper to version 2.0.1. Upgrade AWS Python Wrapper to version 1.4.0. Upgrade AWS PGSQL ODBC driver to version 1.0.1.

Fix

LPE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2025-12967

GHSA-4JVF-WX3F-2X8Q

GHSA-7WQ2-32H4-9HC9

GHSA-7XW4-G7MM-R4HH

GHSA-8WJ8-CFXR-9374

GHSA-Q327-FGM8-7MXF

Affected Products

Aws Go Wrapper

Aws Jdbc Wrapper

Aws Nodejs Wrapper

Aws Pgsql Odbc Driver

Aws Python Wrapper

References · 30

• https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/2.6.5 · Patch
• https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-7xw4-g7mm-r4hh · Vendor Advisory
• https://github.com/aws/aws-advanced-python-wrapper/security/advisories/GHSA-4jvf-wx3f-2x8q · Vendor Advisory
• https://github.com/aws/aws-advanced-python-wrapper/releases/tag/1.4.0 · Patch
• https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2025-10-17 · Patch
• https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9 · Vendor Advisory
• https://github.com/aws/aws-advanced-nodejs-wrapper/releases/tag/2.0.1 · Patch
• https://github.com/aws/aws-advanced-nodejs-wrapper/security/advisories/GHSA-8wj8-cfxr-9374 · Vendor Advisory
• https://github.com/aws/aws-pgsql-odbc/security/advisories/GHSA-q327-fgm8-7mxf · Vendor Advisory
• https://github.com/aws/aws-pgsql-odbc/releases/tag/1.0.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-12967 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12967 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wj8-cfxr-9374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7wq2-32h4-9hc9 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2025-028 · Vendor Advisory