CVE-2025-14763: Amazon S3 Encryption Client for Java Key Commitment Issue
Summary
CVE-2025-14763: Amazon S3 Encryption Client for Java has a Key Commitment Issue. Affects software.amazon.encryption.s3:amazon-s3-encryption-client-java versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Amazon S3 Encryption Client for Java is an open-source library designed for client-side encryption, enabling users to securely write and read encrypted records to Amazon S3. It provides a mechanism for encrypting data before it is uploaded to S3, ensuring that sensitive information remains protected. However, certain versions of this library have a vulnerability related to key commitment, which can compromise the security of encrypted data.
Vulnerability Detail
The vulnerability arises when the encrypted data key (EDK) is stored in an 'Instruction File' rather than in S3's metadata. This exposes the EDK to an 'Invisible Salamanders' attack, allowing a malicious actor to replace the EDK with a rogue key. This can lead to unauthorized decryption of sensitive data, as the rogue key can produce valid plaintext messages from the encrypted ciphertext. The lack of key commitment means that multiple EDKs can be associated with the same encrypted message, making it possible for attackers to exploit this weakness.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The only recommended action is to upgrade to the latest version of the S3 Encryption Client.
Conclusion
The Amazon S3 Encryption Client for Java has a key commitment vulnerability that can expose sensitive data to unauthorized access. Users are strongly advised to upgrade to version 4.0.0 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for software.amazon.encryption.s3:amazon-s3-encryption-client-java →
FAQ
The vulnerability involves a key commitment issue where the encrypted data key can be replaced, leading to potential unauthorized decryption of sensitive data.
Versions of the Amazon S3 Encryption Client for Java up to and including v3.5 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Regularly update your dependencies and monitor for vulnerabilities using tools like Vulert to ensure your application remains secure.
