Normj

**Name of the Vulnerable Software and Affected Versions** Amazon S3 Encryption Client for .NET versions prior to 3.2.0 **Description** A flaw exists in the Amazon S3 Encryption Client for .NET where a missing cryptographic key commitment could allow a user with write access to an S3 bucket to introduce a new encryption data key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record. **Recommendations** Upgrade Amazon S3 Encryption Client for .NET to version 3.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** AWS SDK for C++ versions prior to 1.11.712 **Description** A missing cryptographic key commitment in the AWS SDK for C++ could allow a user with write access to an S3 bucket to introduce a new encryption data key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record. **Recommendations** Upgrade AWS SDK for C++ to version 1.11.712 or later.

**Name of the Vulnerable Software and Affected Versions** AWS SDK for PHP versions prior to 3.368.0 **Description** A missing cryptographic key commitment in the AWS SDK for PHP could allow a user with write access to an S3 bucket to introduce a new Encryption Data Key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record. **Recommendations** Upgrade AWS SDK for PHP to version 3.368.0 or later.

**Name of the Vulnerable Software and Affected Versions** AWS SDK for Ruby versions prior to 1.208.0 **Description** A missing cryptographic key commitment in the AWS SDK for Ruby could allow a user with write access to an S3 bucket to introduce a new encryption data key (EDK) that decrypts to different plaintext. This is possible when the encrypted data key is stored in an instruction file instead of S3’s metadata record. **Recommendations** Upgrade AWS SDK for Ruby to version 1.208.0 or later.