aws-encryption-sdk is an AWS Encryption SDK implementation for Python
Affected versions of this package are vulnerable to Inadequate Encryption Strength. A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript. Due to the non-committing property of
AES-GCM (and other
AEAD ciphers such as
(X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting.
aws-encryption-sdk to version 2.0.0 or higher.