5.3Orta
CVE-2024-23680AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
Açıklama
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
Zayıflık türü (CWE):
CWE-347
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| amazon | aws encryption sdk | 2.0.0 – < 2.2.0 | |
| — | com.amazonaws:aws-encryption-sdk-java | 2.0.0 – < 2.2.0, < 1.9.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- GitHub Security Advisory (GHSA-55xh-53m6-936r) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r third-party-advisory