Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-23680 EUVD-2024-0361GHSA-55xh-53m6-936rGHSA-gvc7-gjrw-hj65

AWS Encryption SDK for Java Improper Verification of Cryptographic Signature

Published Jan 19, 2024 · Updated Nov 8, 2026 · Assigned by VulnCheck

Package: com.amazonaws:aws-encryption-sdk-java Ecosystem: Maven

Description

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.

Affected products

VendorProductAffectedFixed
— com.amazonaws:aws-encryption-sdk-java 2.0.0 – < 2.2.0, < 1.9.0 2.2.0

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.amazonaws:aws-encryption-sdk-java < 1.9.0 1.9.0 GHSA-55xh-53m6-936r
Maven com.amazonaws:aws-encryption-sdk-java >= 2.0.0, < 2.2.0 2.2.0 GHSA-55xh-53m6-936r

References