Description
An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Amazon | WorkSpaces Client | 5.0.0 – < 5.21.0, 2023.0 – < 2024.2, 5.5.0 – < 5.21.0 | 5.21.0 |
| Amazon | AppStream 2.0 Client | 1.1.1025 – < 1.1.1332 | 1.1.1332 |
| Amazon | DCV Client | < 2023.1.6703, 2020.2.7459 – < 2023.1.9127, 2020.2.2078 – < 2023.1.6703 | 2023.1.6703 |
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-001/ vendor-advisory
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes patch release-notes
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes patch release-notes
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes patch release-notes
- https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html patch release-notes
- https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul patch release-notes