CVE-2020-8897

Katalog CVE

CVSS 8.1 · High EPSS 0,40%

Kerentanan Cryptographic Issues pada amazon aws encryption sdk. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.

Rincian

Terbit di NVD

16 November 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-310: Cryptographic Issues
CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/blogs/security/improved-client-side-encryption-explicit-keyids-and-key-commitment/ advisory vendor
• https://github.com/google/security-research/security/advisories/GHSA-wqgp-vphw-hphf exploit · mitigasi · advisory pihak ketiga