{"id":"GHSA-7wq2-32h4-9hc9","summary":"AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance","details":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nWe recommend customers upgrade to the following versions:  AWS Go Wrapper to 2025-10-17\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products & versions: \nAWS Go Wrapper \u003c 2025-10-17\n\n\n### Platforms:\n MacOS/Windows/Linux","aliases":["GO-2025-4119"],"modified":"2026-05-06T23:35:18.227635Z","published":"2025-11-13T22:22:34Z","related":["CVE-2025-12967"],"database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-11-13T22:22:34Z","nvd_published_at":null,"cwe_ids":["CWE-470"]},"references":[{"type":"WEB","url":"https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9"},{"type":"WEB","url":"https://github.com/aws/aws-advanced-go-wrapper/pull/270"},{"type":"WEB","url":"https://github.com/aws/aws-advanced-go-wrapper/commit/7b405f95fe71db644cd8336ba5fa28b41e89d03e"},{"type":"PACKAGE","url":"https://github.com/aws/aws-advanced-go-wrapper"}],"affected":[{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/awssql","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/awssql"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/auth-helpers","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/auth-helpers"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/federated-auth","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/federated-auth"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/iam","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/iam"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/mysql-driver","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/mysql-driver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/okta","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/okta"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/otlp","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/otlp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/pgx-driver","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/pgx-driver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}},{"package":{"name":"github.com/aws/aws-advanced-go-wrapper/xray","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-advanced-go-wrapper/xray"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}