{"id":"GHSA-7wq2-32h4-9hc9","aliases":["GO-2025-4119"],"status":"published","title":"AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance","description":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nWe recommend customers upgrade to the following versions:  AWS Go Wrapper to 2025-10-17\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS Go Wrapper \u003c 2025-10-17\n\n\n### Platforms:\n MacOS/Windows/Linux","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470"],"published":"2025-11-13T22:22:34Z","modified":"2026-05-06T23:35:18Z","fixes":[{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/awssql","fixed_in":["1.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/auth-helpers","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/federated-auth","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/iam","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/mysql-driver","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/okta","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/otlp","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/pgx-driver","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/xray","fixed_in":["1.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/awssql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/auth-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/federated-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/iam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/mysql-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/okta","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/otlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/pgx-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/xray","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/awssql","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/auth-helpers","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/federated-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/iam","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/mysql-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/okta","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/otlp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/pgx-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/xray","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-advanced-go-wrapper/awssql","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]}],"references":[{"url":"https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9","tags":["web","advisory"]},{"url":"https://github.com/aws/aws-advanced-go-wrapper/pull/270","tags":["web"]},{"url":"https://github.com/aws/aws-advanced-go-wrapper/commit/7b405f95fe71db644cd8336ba5fa28b41e89d03e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7wq2-32h4-9hc9"},{"url":"https://github.com/aws/aws-advanced-go-wrapper","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-7wq2-32h4-9hc9","title":"AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance","description":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nWe recommend customers upgrade to the following versions:  AWS Go Wrapper to 2025-10-17\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS Go Wrapper \u003c 2025-10-17\n\n\n### Platforms:\n MacOS/Windows/Linux","status":"published","published":"2025-11-13T22:22:34Z","modified":"2026-05-06T23:24:26Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"osv":[{"id":"GHSA-7wq2-32h4-9hc9","title":"AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance","description":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nWe recommend customers upgrade to the following versions:  AWS Go Wrapper to 2025-10-17\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS Go Wrapper \u003c 2025-10-17\n\n\n### Platforms:\n MacOS/Windows/Linux","status":"published","published":"2025-11-13T22:22:34Z","modified":"2026-05-06T23:35:18.227635Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"GO-2025-4119","title":"AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql","description":"AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql","status":"published","published":"2025-11-17T19:11:25Z","modified":"2026-03-03T04:57:36.660103Z","updated_at":"2026-11-02T15:47:02.011123Z"}]}}