Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
Summary
GHSA-h45p-w933-jxh3: Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript. Affects @aws-crypto/client-browser across 2 version ranges.
< 1.9.0
>= 2.0.0, < 2.2.0
Fixed in 1.9.0 or 2.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aws-encryption-sdk-javascript is a library that provides encryption and decryption functionality for AWS services. It supports a streaming mode where callers can stream the plaintext of signed messages before the ECDSA signature is validated. The library also uses AES-GCM encryption and verifies the plaintext before releasing it to the caller. However, there are several low severity issues related to streaming signed messages and restricting the processing of certain types of invalid messages.
Vulnerability Detail
The vulnerability in aws-encryption-sdk-javascript allows an actor with trusted KMS permissions to decrypt a message to also encrypt messages without validating the ECDSA signature. While there is no impact on the integrity of the ciphertext or decrypted plaintext, this could affect the non-repudiation aspect of the ECDSA signature. Additionally, there is a potential risk for processing messages from untrusted sources, as the library may attempt to process a large number of Encrypted Data Keys (EDKs) per message. This could result in excessive AWS KMS Decrypt API calls. The vulnerability also allows for early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.01.9.0npm install @aws-crypto/client-browser@1.9.0 -
>= 2.0.0, < 2.2.02.2.0npm install @aws-crypto/client-browser@2.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in aws-encryption-sdk-javascript has been addressed in versions 1.9 and 2.2. It is recommended that all users upgrade to these fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @aws-crypto/client-browser →
FAQ
The vulnerability allows an actor with trusted KMS permissions to decrypt a message to also encrypt messages without validating the ECDSA signature. This could affect the non-repudiation aspect of the ECDSA signature.
Upgrade to versions 1.9 or 2.2 of the aws-encryption-sdk-javascript library.
No, there are no specific workarounds mentioned for this vulnerability.
Yes, if processing messages from untrusted sources, the library may attempt to process a large number of Encrypted Data Keys (EDKs) per message, resulting in excessive AWS KMS Decrypt API calls.
The vulnerability has been fixed in versions 1.9 and 2.2 of the aws-encryption-sdk-javascript library.
