Lucene search

PRIOn knowledge basePRION:CVE-2024-23680

HistoryJan 19, 2024 - 9:15 p.m.

Code injection

2024-01-1921:15:00

PRIOn knowledge base

www.prio-n.com

aws encryption sdk

java

code injection

vulnerability

ecdsa signatures

nvd

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.6%

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.

CPENameOperatorVersion
aws_encryption_sdkge2.0.0
aws_encryption_sdklt2.2.0
aws_encryption_sdklt1.9.0

Name	Operator	Version
aws_encryption_sdk	ge	2.0.0
aws_encryption_sdk	lt	2.2.0
aws_encryption_sdk	lt	1.9.0

References

github.com/advisories/GHSA-55xh-53m6-936r

github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r

vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r