CVE-2020-8897: Use of a Broken or Risky Cryptographic Algorithm

October 12, 2021

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to or later.

References

aws.amazon.com/blogs/security/improved-client-side-encryption-explicit-keyids-and-key-commitment/
github.com/advisories/GHSA-wqgp-vphw-hphf
github.com/google/security-research/security/advisories/GHSA-wqgp-vphw-hphf
nvd.nist.gov/vuln/detail/CVE-2020-8897

Code Behaviors & Features

Detect and mitigate CVE-2020-8897 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →