GHSA-w736-hf9p-qqh3 Key Caching behavior in the DynamoDB Encryption Client.
The DynamoDB Encryption Client may continue using revoked keys due to caching flaws, allowing unauthorized data access despite permission changes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-w736-hf9p-qqh3?
GHSA-w736-hf9p-qqh3 is a vulnerability in com.amazonaws:aws-dynamodb-encryption-java, published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.
When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.
Patches
Fixed as of 1.15.0. We recommend users to modify their code and adopt CachingMostRecentProvider.
Workarounds
Users who cannot upgrade to use the CachingMostRecentProvider can call clear() on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
Which versions are affected by GHSA-w736-hf9p-qqh3?
2 open source packages ship an affected version, including com.amazonaws:aws-dynamodb-encryption-java.
| Package | Affected | Fixed in |
|---|---|---|
com.amazonaws:aws-dynamodb-encryption-java Maven | All versions | 1.15.0 |
com.amazonaws:aws-dynamodb-encryption-java Maven | All versions | 1.15.0 |
How do I fix GHSA-w736-hf9p-qqh3?
Upgrade com.amazonaws:aws-dynamodb-encryption-java to 1.15.0 or later.
Is GHSA-w736-hf9p-qqh3 being exploited?
There is no known exploitation of GHSA-w736-hf9p-qqh3 in the wild and no public exploit code.