Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.

An update of the rubygem package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3
    bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored
    in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for Ruby
    to version 1.208.0 or later. (CVE-2025-14762)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3     bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored     in an instruction file instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for Ruby     to version 1.208.0 or later. (CVE-2025-14762)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
332485	Photon OS 5.0: Rubygem PHSA-2026-5.0-91-0733	Nessus	PhotonOS Local Security Checks	Local	medium
282550	Photon OS 5.0: Rubygem PHSA-2026-5.0-0733	Nessus	PhotonOS Local Security Checks	Local	medium
282501	Photon OS 4.0: Rubygem PHSA-2026-4.0-0942	Nessus	PhotonOS Local Security Checks	Local	medium
436437	SCA: security update for aws-sdk-s3 (GHSA-2xgq-q749-89fq)	Tenable Cloud Security	SCA Checks	Local	medium
436437	SCA: security update for aws-sdk-s3 (GHSA-2xgq-q749-89fq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
279261	Linux Distros Unpatched Vulnerability : CVE-2025-14762	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-14762

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium