Amazon Vulnerabilities and Affected Products
Vulnerabilities associated with AWS SDK.
Products
Clear product- Amazon Athena ODBC driver6 vulnerabilities
- data.all5 vulnerabilities
- Amazon Redshift JDBC Driver2 vulnerabilities
- Fire TV Stick 3rd gen2 vulnerabilities
- WorkSpaces Client2 vulnerabilities
- Amazon Ion Dotnet1 vulnerability
- Amazon Music Player1 vulnerability
- Amazon Redshift ODBC Driver1 vulnerability
- Amazon Redshift Python Connector1 vulnerability
- Amazon WorkSpaces1 vulnerability
- Amazon.ApplicationLoadBalancer.Identity.AspNetCore Middleware1 vulnerability
- Amazon.IonDotnet1 vulnerability
- Amplify Studio1 vulnerability
- AppStream 2.0 Client1 vulnerability
- Aurora MySQL1 vulnerability
- AWS ALB Route Directive Adapter For Istio1 vulnerability
- AWS EFS CSI Driver1 vulnerability
- AWS SDK1 vulnerability
- aws-dataall1 vulnerability
- aws-load-balancer-controller1 vulnerability
- aws_alb_route_directive_adapter_for_istio1 vulnerability
- aws_client_vpn1 vulnerability
- Blink XT2 Sync Module firmware1 vulnerability
- Cloud Cam1 vulnerability
- DCV Client1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Robustness weakness in AWS KMS and Encryption SDKsA weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later. | CVSS-v4.0 | EPSS0.399% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |