Improper Validation of ECDSA Signatures in AWS Encryption SDK for Java

CVE-2024-23680

What is CVE-2024-23680?

The AWS Encryption SDK for Java versions ranging from 2.0.0 to 2.2.0 and any versions less than 1.9.0 are affected by a vulnerability that arises from inadequate validation of certain invalid ECDSA signatures. This flaw could potentially allow an attacker to exploit the improper signature validation, leading to unauthorized access or manipulation of sensitive data. AWS recommends reviewing the affected versions and applying necessary updates to mitigate risks associated with this vulnerability.

References