Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@aws-crypto/client-browser

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

    GHSA-h45p-w933-jxh3

    Affected
    • npm @aws-crypto/client-browser < 1.9.0; >= 2.0.0, < 2.2.0
    Fixed in
    2.2.01.9.0· Vendor fix available
    Issue
    Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to…

    Recommended action: Upgrade to 2.2.0 or 1.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →