CVE-2020-8897: Security issues in AWS KMS and AWS Encryption SDKs
Summary
CVE-2020-8897: Security issues in AWS KMS and AWS Encryption SDKs: in-band protocol negotiation and robustness. Affects com.amazonaws:aws-encryption-sdk-java versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Also tracked for
- aws-encryption-sdk · PyPI
The same CVE-2020-8897 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS Encryption SDKs are a set of open-source libraries that provide client-side encryption for data stored in AWS services. They utilize the AWS Key Management Service (KMS) to manage encryption keys and perform cryptographic operations. The vulnerability affects all versions of the AWS Encryption SDKs prior to version 2.0.0. The AWS KMS is a managed service that enables the creation and control of encryption keys used to encrypt data in AWS services. It provides a secure and scalable solution for key management. The vulnerability allows for information leakage, ciphertext forgery, and robustness issues in the encryption process.
Vulnerability Detail
The vulnerability consists of three security issues. Firstly, an attacker can create ciphertexts that leak the user's AWS account ID, encryption context, user agent, and IP address upon decryption. Secondly, an attacker can create ciphertexts that are accepted by other users, leading to ciphertext forgery. Lastly, the non-committing property of AES-GCM and other AEAD ciphers can result in ciphertexts decrypting to different plaintexts for different users. These vulnerabilities are a result of in-band protocol negotiation and can be exploited by manipulating the key ID and wrapped DEK in the ciphertext.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The security vulnerabilities in AWS KMS and AWS Encryption SDKs can lead to information leakage, ciphertext forgery, and the decryption of different plaintexts for different users. It is crucial for users to upgrade to version 2.0.0 of the SDKs to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.amazonaws:aws-encryption-sdk-java →
FAQ
The vulnerabilities can lead to information leakage, ciphertext forgery, and the decryption of different plaintexts for different users. This can result in unauthorized access to sensitive data and the potential compromise of AWS accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No specific workarounds have been provided for these vulnerabilities. It is recommended to upgrade to version 2.0.0 of the AWS Encryption SDKs to mitigate the risks.
Yes, these vulnerabilities can be exploited remotely by an attacker who can intercept and modify ciphertexts.
Yes, the CVSS score for these vulnerabilities is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.amazonaws:aws-encryption-sdk-java.
