GHSA-MHGM-52VG-PVVC Privilege escalation in Strongbox

Impact An attacker with read-only access to a Strongbox secret could craft a valid encrypted secret same id/version. It also makes the audit logs from KMS less useful. The issue is caused by a bug in the underlying AWS Encryption SDK. By default, the encrypted secrets are stored in DynamoDB and a...

com.schibsted.security:strongbox-sdk (0.4.0) potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (0.0.1)

com.amazonaws:aws-encryption-sdk-java MAVEN version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.schibsted.security:strongbox-sdk 0.4.0 Source cves: CVE-2020-8897 Source advisory...

com.eoniantech:secrets-locker (>=1.0, <=1.1), com.github.seanroy:lambda-maven-plugin (>=2.3.2, <=2.3.3) potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (1.3.1)

com.amazonaws:aws-encryption-sdk-java MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.eoniantech:secrets-locker =1.0, =2.3.2, =2.3.3 Source cves: CVE-2020-8897 Source...

com.eoniantech:secrets-locker (1.2), com.px100systems:ignite-storage (>=0.3.0, <=0.3.1) +3 more potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (1.3.2)

com.amazonaws:aws-encryption-sdk-java MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.eoniantech:secrets-locker 1.2 - com.px100systems:ignite-storage =0.3.0, =2.8.0,...

br.com.guiabolso:hyperloop-transport (3.0.1), software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin (2.0.12) potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (1.7.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - br.com.guiabolso:hyperloop-transport 3.0.1 -...

br.com.guiabolso:hyperloop-transport (3.0.2) potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (1.9.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - br.com.guiabolso:hyperloop-transport 3.0.2 Source cves: CVE-2020-8897 Source advisory...

cloud-backup (1.0.0) potentially affected by CVE-2020-8897 via aws-encryption-sdk (1.3.7)

aws-encryption-sdk PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - cloud-backup 1.0.0 Source cves: CVE-2020-8897 Source advisory: OSV:GHSA-WQGP-VPHW-HPHF...

samsteady-python-crypto (>=1.0.2, <=1.0.17) potentially affected by CVE-2020-8897 via aws-encryption-sdk (1.4.1)

aws-encryption-sdk PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - samsteady-python-crypto =1.0.2, =1.0.17 Source cves: CVE-2020-8897 Source advisory: OSV:GHSA-WQGP-VPHW-HPHF...

aws-encryption-sdk-cli (>=1.8.0, <=1.9.0) potentially affected by CVE-2020-8897 via aws-encryption-sdk (1.10.1)

aws-encryption-sdk PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - aws-encryption-sdk-cli =1.8.0, =1.9.0 Source cves: CVE-2020-8897 Source advisory: OSV:GHSA-WQGP-VPHW-HPHF...

Use of a Broken or Risky Cryptographic Algorithm

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

GHSA-X5H4-9GQW-942J Improper Verification of Cryptographic Signature in aws-encryption-sdk

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...

cloud-backup (1.0.0), samsteady-python-crypto (>=1.0.2, <=1.0.17) potentially affected by unknown CVE via aws-encryption-sdk (>=1.3.7, <=1.4.1)

aws-encryption-sdk PYPI version =1.3.7, =1.0.2, =1.0.17 Source cves: unknown CVE Source advisory: OSV:GHSA-X5H4-9GQW-942J...

cloudformation-cli-python-lib (2.1.9) potentially affected by unknown CVE via aws-encryption-sdk (2.0.0)

aws-encryption-sdk PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - cloudformation-cli-python-lib 2.1.9 Source cves: unknown CVE Source advisory: OSV:GHSA-X5H4-9GQW-942J...

cloud-backup (1.0.0), samsteady-python-crypto (>=1.0.2, <=1.0.17) potentially affected by unknown CVE via aws-encryption-sdk (>=1.3.7, <=1.4.1)

aws-encryption-sdk PYPI version =1.3.7, =1.0.2, =1.0.17 Source cves: unknown CVE Source advisory: GHSA-X5H4-9GQW-942J...

cloudformation-cli-python-lib (2.1.9) potentially affected by unknown CVE via aws-encryption-sdk (2.0.0)

aws-encryption-sdk PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - cloudformation-cli-python-lib 2.1.9 Source cves: unknown CVE Source advisory: GHSA-X5H4-9GQW-942J...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...

GHSA-55XH-53M6-936R Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...

com.schibsted.security:strongbox-sdk (0.4.0) potentially affected by CVE-2024-23680 via com.amazonaws:aws-encryption-sdk-java (0.0.1)

com.amazonaws:aws-encryption-sdk-java MAVEN version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.schibsted.security:strongbox-sdk 0.4.0 Source cves: CVE-2024-23680 Source advisor...

br.com.guiabolso:hyperloop-transport (3.0.1), com.eoniantech:secrets-locker (>=1.0, <=1.2) +7 more potentially affected by CVE-2024-23680 via com.amazonaws:aws-encryption-sdk-java (>=1.3.1, <=1.7.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version =1.3.1, =1.0, =2.3.2, =0.3.0, =2.8.0, =2.11.1 - org.apache.ignite:ignite-aws-ext 1.0.0 - org.dreamhorizon:vertx-cron 1.0.0 - software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin 2.0.12 Source cves: CVE-2024-23680 Source advisory:...

br.com.guiabolso:hyperloop-transport (3.0.1), com.eoniantech:secrets-locker (>=1.0, <=1.2) +7 more potentially affected by CVE-2024-23680 via com.amazonaws:aws-encryption-sdk-java (>=1.3.1, <=1.7.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version =1.3.1, =1.0, =2.3.2, =0.3.0, =2.8.0, =2.11.1 - org.apache.ignite:ignite-aws-ext 1.0.0 - org.dreamhorizon:vertx-cron 1.0.0 - software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin 2.0.12 Source cves: CVE-2024-23680 Source advisory:...