CVE-2025-14762

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue,...

CVE-2025-14761

The CVE-2025-14761 issue affects the AWS SDK for PHP S3 Encryption Client. When the encrypted data key (EDK) is stored in an Instruction File rather than S3 metadata, a lack of key commitment can allow a rogue EDK to decrypt the same ciphertext to different plaintext. Affected behavior is describ...