CVE-2020-8897mediumCWE-310

CVE-2020-8897: falha de média gravidade em Amazon AWS SDK

Robustness weakness in AWS KMS and Encryption SDKs

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar AWS SDK+ Monitorar com.amazonaws:aws-encryption-sdk-java

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.4%
A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
Amazon · AWS SDK