Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.amazonaws:aws-dynamodb-encryption-java

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedMavenPublished

    Key Caching behavior in the DynamoDB Encryption Client.

    GHSA-w736-hf9p-qqh3

    Affected
    • Maven com.amazonaws:aws-dynamodb-encryption-java < 1.15.0
    Fixed in
    1.15.0· Vendor fix available
    Issue
    Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider. Patches Fixed as of 1.15.0. We recommend users to modify their code and adopt CachingMostRecentProvider. Workarounds Users who cannot upgrade to use the CachingMostRecentProvider can call clear() on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.

    Recommended action: Upgrade to 1.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →