CVE-2024-23680

2024-01-1921:15:10

CWE-347

[email protected]

web.nvd.nist.gov

aws

encryption sdk

java

cve-2024-23680

nvd

security vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.

Affected configurations

NVD

Node

amazonaws_encryption_sdkRange<1.9.0

amazonaws_encryption_sdkRange2.0.0–2.2.0

CPENameOperatorVersion
amazon:aws_encryption_sdkamazon aws encryption sdklt1.9.0
amazon:aws_encryption_sdkamazon aws encryption sdklt2.2.0

CPE	Name	Operator	Version
amazon:aws_encryption_sdk	amazon aws encryption sdk	lt	1.9.0
amazon:aws_encryption_sdk	amazon aws encryption sdk	lt	2.2.0

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "com.amazonaws:aws-encryption-sdk-java",
    "versions": [
      {
        "lessThan": "2.2.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "maven"
      },
      {
        "lessThan": "1.9.0",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]