5.3Media
CVE-2024-23680AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
Descripción
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
Debilidad (CWE):
CWE-347
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| amazon | aws encryption sdk | 2.0.0 – < 2.2.0 | |
| — | com.amazonaws:aws-encryption-sdk-java | 2.0.0 – < 2.2.0, < 1.9.0 |
Referencias y parches
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r third-party-advisory