CVE-2025-12967: AWS Advanced Python Wrapper Privilege Escalation Vulnerability
HIGHCVE-2025-12967 is a HIGH (CVSS 8.0) privilege escalation vulnerability (CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')) affecting AWS Advanced Python Wrapper libraries in the PyPI ecosystem. The issue involves privilege escalation in aurora postgresql instance. Remediation is available by upgrading affected packages to version 1.4.0.
CVE-2025-12967 at a Glance
Security Impact
CVSS: 8.0
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
How to Fix CVE-2025-12967
To remediate this vulnerability, upgrade all affected AWS Advanced Python Wrapper dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install aws_advanced_python_wrapper>=1.4.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show aws_advanced_python_wrapperHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2025-12967, inspect your installed packages using pip:
pip show aws_advanced_python_wrapperAnalyze the terminal output to locate any version of AWS Advanced Python Wrapper in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.0), your application is affected.
Note: The pip show aws_advanced_python_wrapper command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'), where the product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. In AWS Advanced Python Wrapper, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-12967 Affected AWS Advanced Python Wrapper Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
aws_advanced_python_wrapper
|
PyPI |
< 1.4.0
|
1.4.0
|
References
Frequently Asked Questions
What is CVE-2025-12967?
Which AWS Advanced Python Wrapper versions are affected?
What version fixes CVE-2025-12967?
Is aws_advanced_python_wrapper affected?
What is the CVSS score of CVE-2025-12967?
What CWE is associated with CVE-2025-12967?
How can I check PyPI dependencies for CVE-2025-12967?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4jvf-wx3f-2x8q",
"modified" : "2025-11-13T22:22:07Z",
"published" : "2025-11-13T22:22:07Z",
"aliases" : [ "CVE-2025-12967" ],
"summary" : "AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance ",
"details" : "### Description of Vulnerability:\n\nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nAWS recommends customers upgrade to the following versions: AWS Python Wrapper to v1.4.0\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim <allistair.hakim@gmail.com>\n\n\n### Affected products & versions: \nAWS Python Wrapper < 1.4.0\n\n\n### Platforms: \nMacOS/Windows/Linux",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "aws_advanced_python_wrapper"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.4.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-7xw4-g7mm-r4hh"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/aws-advanced-python-wrapper/security/advisories/GHSA-4jvf-wx3f-2x8q"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/aws-pgsql-odbc/security/advisories/GHSA-q327-fgm8-7mxf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-12967"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/aws-advanced-python-wrapper/pull/1007"
}, {
"type" : "WEB",
"url" : "https://aws.amazon.com/security/security-bulletins/AWS-2025-028"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/aws/aws-advanced-python-wrapper"
}, {
"type" : "WEB",
"url" : "https://github.com/aws/aws-advanced-python-wrapper/releases/tag/1.4.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-470" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-11-13T22:22:07Z",
"nvd_published_at" : "2025-11-10T18:16:06Z"
}
}