CVE-2020-36363 Weak cryptography in n/a
AWS CloudFront allows weak CBC-mode ciphers in TLSv1.2_2019, potentially enabling cryptographic attacks against encrypted traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36363?
CVE-2020-36363 is a critical vulnerability in n/a, published on 12 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entities consider to be weak ciphers.
Weakness: CWE-327
Which versions are affected by CVE-2020-36363?
It affects 1 product.
Products include Amazon Amazon Cloudfront.
How do I fix CVE-2020-36363?
No fix has been published for CVE-2020-36363 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36363 being exploited?
There is no known exploitation of CVE-2020-36363 in the wild and no public exploit code.
Sources
Also known as GHSA-mwmh-v67h-98jp.