{"cve":"CVE-2025-14762","nvd":{"published":"2025-12-17T21:15:53.517","modified":"2026-09-30T23:10:00.237","status":"Deferred","description":"Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\n\nTo mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.3},"cwes":["CWE-327"],"references":["https://aws.amazon.com/security/security-bulletins/AWS-2025-032/","https://github.com/aws/aws-sdk-ruby/security/advisories/GHSA-2xgq-q749-89fq","https://rubygems.org/gems/aws-sdk-s3/versions/1.208.0"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-14762","score":0.00207,"percentile":0.10683,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-2xgq-q749-89fq","url":"https://osv.dev/vulnerability/GHSA-2xgq-q749-89fq","summary":"AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue","modified":"2026-09-10T03:50:31.227725604Z","packages":[{"ecosystem":"RubyGems","name":"aws-sdk-s3","purl":"pkg:gem/aws-sdk-s3","ranges":["<1.208.0"],"fixed":["1.208.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}