5.3Medium
CVE-2024-23680AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
Description
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
Weakness (CWE):
CWE-347
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| amazon | aws encryption sdk | 2.0.0 – < 2.2.0 | |
| — | com.amazonaws:aws-encryption-sdk-java | 2.0.0 – < 2.2.0, < 1.9.0 |
References and patches
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r third-party-advisory