PT-2025-51882 · Amazon Web Services · Aws Sdk For Php

Normj · Published 2025-12-17 · Updated 2025-12-23 · CVE-2025-14761

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS SDK for PHP versions prior to 3.368.0

Description A missing cryptographic key commitment in the AWS SDK for PHP could allow a user with write access to an S3 bucket to introduce a new Encryption Data Key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record.

Recommendations Upgrade AWS SDK for PHP to version 3.368.0 or later.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2025-14761

GHSA-X8CP-JF6F-R4XH

Affected Products

Aws Sdk For Php

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2025-14761.yaml · Exploit
• https://github.com/aws/aws-sdk-php/releases/tag/3.368.0 · Patch
• https://osv.dev/vulnerability/CVE-2025-14761 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2025-032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14761 · Security Note
• https://osv.dev/vulnerability/GHSA-x8cp-jf6f-r4xh · Vendor Advisory
• https://github.com/aws/aws-sdk-php/security/advisories/GHSA-x8cp-jf6f-r4xh · Note
• https://github.com/aws/aws-sdk-php · Note
• https://github.com/aws/aws-sdk-php/commit/6827cac70397dca07e6e86f7cf630954ec2bc6bf · Note
• https://reddit.com/r/VulnMatter/comments/1pt1cm5/resumen_diario_de_vulnerabilidades_22122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1pttxj6/resumen_diario_de_vulnerabilidades_23122025 · Reddit Post
• https://twitter.com/CVEnew/status/2002835965870477388 · Twitter Post