CVE-2024-23680

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-23680

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23680.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-23680

Aliases

GHSA-55xh-53m6-936r

Published

2024-01-19T20:44:34.957Z

Modified

2026-07-16T03:30:51.198324808Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

AWS Encryption SDK for Java Improper Verification of Cryptographic Signature

Details

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.

Database specific

{
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23680.json"
}

References

Affected packages

Git / github.com/aws/aws-encryption-sdk-java

Affected ranges

Type

GIT

Repo

https://github.com/aws/aws-encryption-sdk-java

Events

Introduced

Fixed

d59c11c79703da8ea86130749b4dc37e0c5dcc86

Introduced

b54780f0c1faac6c9e0a27880e12b0d2623bae67

Fixed

0ce0cb20f6cf78ce8b43d4f2e44d2e1315af495b

Database specific

{
    "cpe": "cpe:2.3:a:amazon:aws_encryption_sdk:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.0"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.2.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*

0.0.1

0.0.1-SNAPSHOT

1.*

1.3.0

1.3.3

1.3.6

1.4.0

1.4.1

1.5.0

1.6.0

1.6.1

1.6.2

v1.*

v1.7.0

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23680.json"