CVE-2024-23680

Summary

CVE-2024-23680 is a vulnerability affecting versions 2.0.0 to 2.2.0 and older than 1.9.0 of the AWS Encryption SDK for Java. The issue lies in the SDK's handling of ECDSA signatures, where it fails to correctly validate some invalid signatures. This error could potentially lead to data being decrypted and read without proper authorization, posing a significant security risk to users. Organizations utilizing the AWS Encryption SDK for Java are advised to upgrade to a patched version to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.