5.3Mittel
CVE-2024-23680AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
Beschreibung
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
Schwachstellentyp (CWE):
CWE-347
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| amazon | aws encryption sdk | 2.0.0 – < 2.2.0 | |
| — | com.amazonaws:aws-encryption-sdk-java | 2.0.0 – < 2.2.0, < 1.9.0 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r third-party-advisory