CVE-2025-12967
High
Description
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. We recommend customers upgrade to the following versions: AWS JDBC Wrapper to v2.6.5, AWS Go Wrapper to 2025-10-17, AWS NodeJS Wrapper to v2.0.1, AWS Python Wrapper to v1.4.0 and AWS PGSQL ODBC driver to v1.0.1
SeverityHigh
CVSS8.0
Exploit probability—
ProductAws-advanced-python-wrapper
PublishedNov 10, 2025
First seenNov 10, 2025
Weakness typeCWE-470CWE-470
How to fix
Update
- aws-advanced-python-wrapper1.4.0 or later
Patches
Vendor advisories
- aws.amazon.com/security/security-bulletins/AWS-2025-028/
- github.com/aws/aws-advanced-python-wrapper/security/advisories/GHSA-4jvf-wx3f-2x8q
- github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-7xw4-g7mm-r4hh
- github.com/aws/aws-pgsql-odbc/security/advisories/GHSA-q327-fgm8-7mxf
- github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9
- github.com/aws/aws-advanced-nodejs-wrapper/security/advisories/GHSA-8wj8-cfxr-9374
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aws-advanced-python-wrapperPyPI | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.