CVE-2024-23680 AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
Attackers can bypass cryptographic signature verification in the AWS Encryption SDK for Java, potentially compromising data integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23680?
CVE-2024-23680 is a medium-severity vulnerability in amazon:aws_encryption_sdk, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
Weakness: CWE-347
Which versions are affected by CVE-2024-23680?
4 open source packages ship an affected version, including com.amazonaws:aws-encryption-sdk-java. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.amazonaws:aws-encryption-sdk-java Maven | All versions | 1.9.0 |
com.amazonaws:aws-encryption-sdk-java Maven | All versions | 1.9.0 |
com.amazonaws:aws-encryption-sdk-java Maven | From 2.0.0 | 2.2.0 |
com.amazonaws:aws-encryption-sdk-java Maven | From 2.0.0 | 2.2.0 |
Products include Amazon Aws Encryption Sdk.
How do I fix CVE-2024-23680?
Upgrade com.amazonaws:aws-encryption-sdk-java to a fixed version for your release line: 1.9.0 or 2.2.0.
Is CVE-2024-23680 being exploited?
There is no known exploitation of CVE-2024-23680 in the wild and no public exploit code.
Other vulnerabilities in amazon:aws_encryption_sdk
Sources
Also known as GHSA-55xh-53m6-936r.