Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceGHSA-4jvf-wx3f-2x8q

GHSA-4jvf-wx3f-2x8q

HIGH8.6

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Published Nov 13, 2025

Modified 4 months ago

Fix available

Details

Description of Vulnerability:

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

AWS recommends customers upgrade to the following versions: AWS Python Wrapper to v1.4.0

Source of Vulnerability Report:

Allistair Ishmael Hakim allistair.hakim@gmail.com

Affected products & versions:

AWS Python Wrapper < 1.4.0

Platforms:

MacOS/Windows/Linux

Affected Packages

aws_advanced_python_wrapper

PyPI

Fixed in:

1.4.0

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-028

https://github.com/advisories/GHSA-4jvf-wx3f-2x8q

https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9

https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-7xw4-g7mm-r4hh

https://github.com/aws/aws-advanced-python-wrapper

https://github.com/aws/aws-advanced-python-wrapper/pull/1007

https://github.com/aws/aws-advanced-python-wrapper/releases/tag/1.4.0

https://github.com/aws/aws-advanced-python-wrapper/security/advisories/GHSA-4jvf-wx3f-2x8q

https://github.com/aws/aws-pgsql-odbc/security/advisories/GHSA-q327-fgm8-7mxf

https://nvd.nist.gov/vuln/detail/CVE-2025-12967

Aliases

CVSS Analysis

CVSS v4.0

8.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

LowPR:L

User Interaction

PassiveUI:P

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

HighVI:H

Vuln. Availability

HighVA:H

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

8.6/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Related

Ecosystems

Timeline

PublishedNov 13, 2025

ModifiedNov 13, 2025

GHSA-4jvf-wx3f-2x8q | Mondoo Vulnerability Intelligence