Amazon Vulnerabilities and Affected Products
Vulnerabilities associated with Amazon.ApplicationLoadBalancer.Identity.AspNetCore Middleware.
Products
Clear product- Amazon Athena ODBC driver6 vulnerabilities
- data.all5 vulnerabilities
- Amazon Redshift JDBC Driver2 vulnerabilities
- Fire TV Stick 3rd gen2 vulnerabilities
- WorkSpaces Client2 vulnerabilities
- Amazon Ion Dotnet1 vulnerability
- Amazon Music Player1 vulnerability
- Amazon Redshift ODBC Driver1 vulnerability
- Amazon Redshift Python Connector1 vulnerability
- Amazon WorkSpaces1 vulnerability
- Amazon.ApplicationLoadBalancer.Identity.AspNetCore Middleware1 vulnerability
- Amazon.IonDotnet1 vulnerability
- Amplify Studio1 vulnerability
- AppStream 2.0 Client1 vulnerability
- Aurora MySQL1 vulnerability
- AWS ALB Route Directive Adapter For Istio1 vulnerability
- AWS EFS CSI Driver1 vulnerability
- AWS SDK1 vulnerability
- aws-dataall1 vulnerability
- aws-load-balancer-controller1 vulnerability
- aws_alb_route_directive_adapter_for_istio1 vulnerability
- aws_client_vpn1 vulnerability
- Blink XT2 Sync Module firmware1 vulnerability
- Cloud Cam1 vulnerability
- DCV Client1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-10125MEDIUM | Lack of JWT issuer and signer validationThe Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer (ALB) OpenId Connect integration and can be used in any ASP.NET https://dotnet.microsoft.com/apps/aspnet Core deployment scenario, including Fargate, EKS, ECS, EC2, and Lambda. In the JWT handling code, it performs signature validation but fails to validate the JWT issue… CWE-290Oct 21, 2024 | CVSS6.9v4.0 | EPSS0.323% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |