CVE-2024-23680: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
Summary
CVE-2024-23680: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java. Affects com.amazonaws:aws-encryption-sdk-java across 2 version ranges.
< 1.9.0
>= 2.0.0, < 2.2.0
Fixed in 1.9.0 or 2.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aws-encryption-sdk-java is a Maven package that provides encryption and decryption functionality for data stored in Amazon Web Services (AWS). It is used to secure sensitive data and ensure its confidentiality. However, versions 2.0.0 to 2.2.0 and less than 1.9.0 of the package contain a vulnerability related to the verification of cryptographic signatures.
Vulnerability Detail
The vulnerability in aws-encryption-sdk-java arises from the incorrect validation of some invalid ECDSA signatures. This flaw allows an attacker to bypass the cryptographic signature verification process, potentially leading to the acceptance of tampered or malicious data. The impact of this vulnerability can range from data integrity compromise to unauthorized access or execution of arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.01.9.0 -
>= 2.0.0, < 2.2.02.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the aws-encryption-sdk-java package to the fixed version as soon as possible.
Conclusion
The aws-encryption-sdk-java package is vulnerable to an improper verification of cryptographic signature issue. It is crucial to update the package to version 1.9.0 or higher to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.amazonaws:aws-encryption-sdk-java →
FAQ
The vulnerability allows an attacker to bypass cryptographic signature verification, potentially leading to data integrity compromise or unauthorized access.
Versions 2.0.0 to 2.2.0 and versions lower than 1.9.0 are affected.
To fix the vulnerability, update the aws-encryption-sdk-java package to version 1.9.0 or higher by modifying the Maven configuration file (pom.xml) and rebuilding the project.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the advisory]
Related vulnerabilities
Recent vulnerabilities recorded for com.amazonaws:aws-encryption-sdk-java.
