Key Caching behavior in the DynamoDB Encryption Client
Summary
GHSA-w736-hf9p-qqh3: Key Caching behavior in the DynamoDB Encryption Client. Affects com.amazonaws:aws-dynamodb-encryption-java versions < 1.15.0. Fixed in 1.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The DynamoDB Encryption Client is a library that provides client-side encryption for Amazon DynamoDB. It allows users to encrypt sensitive data before storing it in DynamoDB, ensuring data confidentiality and integrity. The encryption client supports various key providers, including AWS Key Management Service (KMS), which allows for permissions on keys to be modified. This vulnerability specifically affects users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS KMS.
Vulnerability Detail
The vulnerability arises from a flaw in the time-based key reauthorization logic in MostRecentProvider. When key usage permissions are changed at the key provider, the reauthorization logic fails to reauthorize the use of the key in the DynamoDB Encryption Client. As a result, keys can still be used in the client even after permissions to use them have been revoked at the key provider. This can lead to unauthorized access to encrypted data and a potential breach of data confidentiality.
How To Fix
Minimum fixed version
1.15.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users who cannot immediately upgrade to version 1.15.0 or adopt CachingMostRecentProvider, a workaround is available. They can manually flush the cache by calling the clear() method on the cache object. This will force a re-validation with the key provider the next time the key is used, ensuring that only authorized keys are used.
Conclusion
The Key Caching behavior vulnerability in the DynamoDB Encryption Client exposes users to the risk of unauthorized access to encrypted data. It is crucial for users to upgrade to version 1.15.0 of the client and modify their code to adopt CachingMostRecentProvider to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.amazonaws:aws-dynamodb-encryption-java →
FAQ
The DynamoDB Encryption Client is a library that provides client-side encryption for Amazon DynamoDB. It allows users to encrypt sensitive data before storing it in DynamoDB, ensuring data confidentiality and integrity.
MostRecentProvider is a key provider in the DynamoDB Encryption Client that retrieves the most recent version of a key from the key provider. It is used to ensure that the client always uses the latest authorized version of a key.
AWS Key Management Service (KMS) is a managed service that makes it easy for users to create and control the encryption keys used to encrypt their data. It provides a highly secure and scalable key management solution.
The vulnerability allows for unauthorized access to encrypted data in DynamoDB. This can lead to a breach of data confidentiality and potential misuse of sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
