Inadequate Encryption Strength
Affecting com.amazonaws:aws-encryption-sdk-java artifact, versions [,2.0.0)Report new vulnerabilities
com.amazonaws:aws-encryption-sdk-java is an AWS Encryption SDK for Java
Affected versions of this package are vulnerable to Inadequate Encryption Strength. A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript. Due to the non-committing property of
AES-GCM (and other
AEAD ciphers such as
(X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting.
com.amazonaws:aws-encryption-sdk-java to version 2.0.0 or higher.