CVE-2025-12967: AWS Advanced Python Wrapper Privilege Escalation Vulnerability
Summary
CVE-2025-12967: AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance. Affects aws-advanced-python-wrapper versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS Advanced Python Wrapper is a library designed to facilitate interactions with Amazon Aurora PostgreSQL, providing developers with a simplified interface for database operations. This package is widely used in applications that require robust database management capabilities. However, it has been found to have a critical vulnerability that allows low-privileged authenticated users to escalate their privileges, potentially compromising the security of the database.
Vulnerability Detail
An issue in the AWS Advanced Python Wrapper for Amazon Aurora PostgreSQL allows a low-privileged authenticated user to create a crafted function that can be executed with the permissions of other Amazon RDS users. This vulnerability can lead to unauthorized access and manipulation of sensitive data, as it enables privilege escalation to the rds_superuser role, which has extensive control over the database environment. The vulnerability was reported by Allistair Ishmael Hakim and is classified under CWE-470.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
pip install --upgrade "aws-advanced-python-wrapper==1.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the permissions of low-privileged authenticated users to prevent them from creating crafted functions that could exploit this vulnerability. However, the best course of action is to upgrade to the latest version of the package.
Conclusion
The AWS Advanced Python Wrapper has a critical vulnerability that allows privilege escalation, potentially compromising database security. Users are strongly advised to upgrade to version 1.4.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for aws-advanced-python-wrapper →
FAQ
The vulnerability has a CVSS score of 8.0, indicating a high severity level that requires immediate attention.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data and the ability to perform administrative actions on the database.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
If an immediate upgrade is not possible, consider implementing strict access controls and monitoring to mitigate the risk until the upgrade can be performed.
