Key Caching behavior in the DynamoDB Encryption Client
Summary
GHSA-4ph2-8337-hm62: Key Caching behavior in the DynamoDB Encryption Client. Affects dynamodb-encryption-sdk versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The DynamoDB Encryption Client is a library that provides client-side encryption for Amazon DynamoDB. It allows users to encrypt sensitive data before storing it in DynamoDB and decrypt it when retrieving it. The library supports various key providers, including AWS Key Management Service (KMS), which allows for permissions on keys to be modified. This vulnerability affects the MostRecentProvider in the DynamoDB Encryption Client.
Vulnerability Detail
The vulnerability arises when key usage permissions are changed at the key provider. The time-based key reauthorization logic in MostRecentProvider fails to reauthorize the use of the key. As a result, keys can still be used in the DynamoDB Encryption Client even after permissions to do so have been revoked at the key provider. This can lead to unauthorized access to encrypted data and potential data breaches.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
pip install --upgrade "dynamodb-encryption-sdk==1.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Users who cannot upgrade to version 1.3.0 can manually flush the cache by calling the 'clear()' method on the cache object. This will force a re-validation to occur with the key provider the next time the key is used.
Conclusion
The Key Caching behavior vulnerability in the DynamoDB Encryption Client allows keys to be used even after permissions have been revoked at the key provider. Users are advised to upgrade to version 1.3.0 and modify their code to use the CachingMostRecentProvider. If upgrading is not possible, the cache can be manually flushed to force re-validation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dynamodb-encryption-sdk →
FAQ
The vulnerability allows keys to be used in the DynamoDB Encryption Client even after permissions to do so have been revoked at the key provider. This can lead to unauthorized access to encrypted data.
Versions prior to 1.3.0 are affected by this vulnerability.
Upgrade to version 1.3.0 of the DynamoDB Encryption Client and modify your code to use the CachingMostRecentProvider.
If you cannot upgrade to version 1.3.0, you can manually flush the cache to force re-validation with the key provider.
You can find more information about this vulnerability in the GitHub advisory: [link to advisory]
