p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in aws-encryption-sdk

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für aws-encryption-sdk: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. CVE-2026-6550

    Mittel · CVSS 5.7EPSS 0,1%Korrektur verfügbar

    Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

    Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

    aws-encryption-sdk aws-encryption-sdk aws-encryption-sdkPython
    • Auf 3.3.1 aktualisieren
    • Auf 4.0.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-x5h4-9gqw-942j

    Nicht bewertetKorrektur verfügbar

    Improper Verification of Cryptographic Signature in aws-encryption-sdk

    ### Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS

    aws-encryption-sdk aws-encryption-sdkPython
    • Auf 1.9.0 aktualisieren
    • Auf 2.2.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2020-8897

    Mittel · CVSS 4.8EPSS 0,4%Korrektur verfügbar

    Robustness weakness in AWS KMS and Encryption SDKs

    A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.

    aws-encryption-sdk aws-encryption-sdkPython
    • Auf 2.0.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →