AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
References
| Link | Resource |
|---|---|
| https://github.com/advisories/GHSA-55xh-53m6-936r | Patch Third Party Advisory |
| https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r | Patch Vendor Advisory |
| https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Jan 2024, 19:08
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| Summary |
|
|
| CPE | cpe:2.3:a:amazon:aws_encryption_sdk:*:*:*:*:*:*:*:* | |
| First Time |
Amazon aws Encryption Sdk
Amazon |
|
| References | () https://github.com/advisories/GHSA-55xh-53m6-936r - Patch, Third Party Advisory | |
| References | () https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r - Patch, Vendor Advisory | |
| References | () https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r - Third Party Advisory |
19 Jan 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-19 21:15
Updated : 2024-01-26 19:08
NVD link : CVE-2024-23680
Mitre link : CVE-2024-23680
CVE.ORG link : CVE-2024-23680
JSON object : View
Products Affected
amazon
- aws_encryption_sdk
CWE
CWE-347
Improper Verification of Cryptographic Signature