GHSA-4ph2-8337-hm62 Key Caching behavior in the DynamoDB Encryption Client.
Attackers can bypass key permission revocations in the DynamoDB Encryption Client by exploiting cached key usage, allowing unauthorized data access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4ph2-8337-hm62?
GHSA-4ph2-8337-hm62 is a vulnerability in dynamodb-encryption-sdk, published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.
When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.
Patches
Fixed as of 1.3.0. We recommend users to modify their code and adopt CachingMostRecentProvider.
Workarounds
Users who cannot upgrade to use the CachingMostRecentProvider can call clear() on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
Which versions are affected by GHSA-4ph2-8337-hm62?
2 open source packages ship an affected version, including dynamodb-encryption-sdk.
| Package | Affected | Fixed in |
|---|---|---|
dynamodb-encryption-sdk PyPI | All versions | 1.3.0 |
dynamodb-encryption-sdk PyPI | All versions | 1.3.0 |
How do I fix GHSA-4ph2-8337-hm62?
Upgrade dynamodb-encryption-sdk to 1.3.0 or later.
Is GHSA-4ph2-8337-hm62 being exploited?
There is no known exploitation of GHSA-4ph2-8337-hm62 in the wild and no public exploit code.