PT-2021-12013 · Amazon · Amazon Aws Cloudfront

Published 2021-08-12 · Updated 2021-08-23 · CVE-2020-36363

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Amazon AWS CloudFront (affected versions not specified)

Description: The issue concerns Amazon AWS CloudFront TLSv1.2 2019, which allows the use of TLS ECDHE RSA WITH AES 128 CBC SHA256 and TLS ECDHE RSA WITH AES 256 CBC SHA384. Some entities consider these to be weak ciphers.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2020-36363

Affected Products

Amazon Aws Cloudfront

References · 5

• https://aws.amazon.com/about-aws/whats-new/2020/07/cloudfront-tls-security-policy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36363 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36363 · Vendor Advisory
• https://t.me/cvenotify/19248 · Telegram Post
• https://stackoverflow.com/questions/62071604 · Note