CVE-2024-23680 AWS Encryption SDK for Java Improper Verification of Cryptographic Signature

2024-01-1920:44:34

CWE-347

VulnCheck

www.cve.org

cve-2024-23680

aws encryption sdk

java

cryptographic signature

verification issue

ecdsa

0.001 Low

EPSS

Percentile

20.6%

JSON

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "com.amazonaws:aws-encryption-sdk-java",
    "versions": [
      {
        "lessThan": "2.2.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "maven"
      },
      {
        "lessThan": "1.9.0",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]