com.yandex.cloud:kms-provider-awscrypto (>=2.0, <=2.6) potentially affected by CVE-2024-23680 via com.amazonaws:aws-encryption-sdk-java (2.0.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.yandex.cloud:kms-provider-awscrypto =2.0, =2.6 Source cves: CVE-2024-23680 Source...

com.yandex.cloud:kms-provider-awscrypto (>=2.0, <=2.6) potentially affected by CVE-2024-23680 via com.amazonaws:aws-encryption-sdk-java (2.0.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.amazonaws:aws-encryption-sdk-java and may be impacted: - com.yandex.cloud:kms-provider-awscrypto =2.0, =2.6 Source cves: CVE-2024-23680 Source...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the...

cloud-backup (1.0.0) potentially affected by CVE-2020-8897 via aws-encryption-sdk (1.3.7)

aws-encryption-sdk PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - cloud-backup 1.0.0 Source cves: CVE-2020-8897 Source advisory: OSV:PYSEC-2020-261...

samsteady-python-crypto (>=1.0.2, <=1.0.17) potentially affected by CVE-2020-8897 via aws-encryption-sdk (1.4.1)

aws-encryption-sdk PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - samsteady-python-crypto =1.0.2, =1.0.17 Source cves: CVE-2020-8897 Source advisory: OSV:PYSEC-2020-261...

aws-encryption-sdk-cli (>=1.8.0, <=1.9.0) potentially affected by CVE-2020-8897 via aws-encryption-sdk (1.10.1)

aws-encryption-sdk PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on aws-encryption-sdk and may be impacted: - aws-encryption-sdk-cli =1.8.0, =1.9.0 Source cves: CVE-2020-8897 Source advisory: OSV:PYSEC-2020-261...

br.com.guiabolso:hyperloop-transport (>=3.0.1, <=3.0.2), com.eoniantech:secrets-locker (>=1.0, <=1.2) +8 more potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (>=0.0.1, <=1.9.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version =0.0.1, =3.0.1, =1.0, =2.3.2, =0.3.0, =2.8.0, =2.11.1 - org.apache.ignite:ignite-aws-ext 1.0.0 - org.dreamhorizon:vertx-cron 1.0.0 - software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin 2.0.12 Source cves: CVE-2020-8897 Source...

aws-encryption-sdk-cli (>=1.8.0, <=1.9.0), cloud-backup (1.0.0) +1 more potentially affected by CVE-2020-8897 via aws-encryption-sdk (>=1.3.7, <=1.10.1)

aws-encryption-sdk PYPI version =1.3.7, =1.8.0, =1.0.2, =1.0.17 Source cves: CVE-2020-8897 Source advisory: MEND:CVE-2020-8897...

CVE-2020-8897

CVE-2020-8897 : A weak robustness vulnerability affects the AWS Encryption SDKs for Java, Python, C and Javalcript prior to 2.0.0. The non-committing property of AES-GCM (and related AEAD ciphers) can let an attacker craft a unique ciphertext that decrypts to multiple different results, which is ...