CVE-2025-14764
Missing Key Commitment in Amazon S3 Go Client Enables Data Decryption Manipulation
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: AMZN
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amazon | s3_encryption_client | 4.0.0 |
| amazon | s3_encryption_client | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14764 is a vulnerability in the Amazon S3 Encryption Client for Go where the encrypted data key (EDK) stored in an "Instruction File" can be replaced by an attacker with write access to the S3 bucket. This allows the attacker to introduce a rogue EDK that decrypts the ciphertext into different plaintext, causing data integrity issues. The problem arises because older versions lacked cryptographic key commitment, which ensures that only the original key can decrypt the ciphertext. This vulnerability enables an attacker to manipulate the decrypted data without affecting confidentiality or availability. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with write access to your S3 bucket to replace the encrypted data key with a rogue one, causing your encrypted data to be decrypted into manipulated or unauthorized plaintext. This compromises data integrity, meaning the data you retrieve may have been altered without your knowledge. However, it does not affect the confidentiality or availability of your data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying the version of the Amazon S3 Encryption Client for Go in use and checking if encrypted data keys (EDKs) are stored in Instruction Files rather than S3 metadata. Since the vulnerability requires an attacker to replace Instruction Files with rogue EDKs, monitoring S3 bucket write activities and changes to Instruction Files can help detect exploitation attempts. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Upgrade the Amazon S3 Encryption Client for Go to version 4.0.0 or later, which introduces key commitment to prevent this vulnerability. There are no workarounds; upgrading is required to mitigate the risk. [1]