PT-2020-20358 · Aws · Aws Encryption Sdk
Thai Duong
+1
·
Published
2020-11-16
·
Updated
2021-10-12
·
CVE-2020-8897
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
AWS Encryption SDKs versions prior to 2.0.0
Description
A weak robustness vulnerability exists in the AWS Encryption SDKs due to the non-committing property of AES-GCM and other AEAD ciphers. This allows an attacker to craft a unique ciphertext that decrypts to multiple different results, particularly in a multi-recipient setting. The vulnerability also enables information leakage and ciphertext forgery attacks. An attacker can create ciphertexts that leak the user's AWS account ID, encryption context, user agent, and IP address upon decryption. Additionally, an attacker can create ciphertexts that are accepted by other users. The non-committing property of AES-GCM can cause nonidentical plaintexts when decrypting a single ciphertext with two different keys.
Recommendations
Update the AWS Encryption SDK to version 2.0.0 or later to fix the vulnerability. This new version includes a breaking change that addresses the issue. All users are recommended to upgrade to this version to mitigate the risk of exploitation.
Exploit
Fix
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Aws Encryption Sdk