Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

aws-encryption-sdk-cli

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPyPIAmendedPublished

    Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli

    GHSA-89v2-g37m-g3ff

    Affected
    • PyPI aws-encryption-sdk-cli < 1.9.0; >= 2.0.0, < 2.2.0
    Fixed in
    2.2.01.9.0· Vendor fix available
    Issue
    Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to…

    Recommended action: Upgrade to 2.2.0 or 1.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. UnratedPyPIAmendedPublished

    CLI does not correctly implement strict mode

    GHSA-2xwp-m7mq-7q3r

    Affected
    • PyPI aws-encryption-sdk-cli < 1.8.0; >= 2.0.0, < 2.1.0
    Fixed in
    1.8.02.1.0· Vendor fix available
    Issue
    In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode." Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.

    Recommended action: Upgrade to 2.1.0 or 1.8.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →