CVE-2020-8897

Weak robustness vulnerability in AWS Encryption SDKs (Java, Python, C, JavaScript) < 2.0.0, due to non-committing property of AEAD ciphers

• CVSS 8.1
• CWE-327
• Cryptographic
• Remote

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.

CVE

CVE-2020-8897

CWE

CWE-327

CVSS base score

8.1

Published

2020-11-16

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Data Theft

Fixed by upgrading

Yes

Solution

Update AWS Encryption SDKs to version 2.0.0 or later.

from aws_encryption_sdk import encrypt, decrypt
from aws_encryption_sdk.key_providers.kms import KMSMasterKeyProvider

kms_key_provider = KMSMasterKeyProvider(key_ids=['your-kms-key-id'])

def encrypt(plaintext):
    ciphertext, encryptor_header = encrypt(
        source=plaintext,
        key_provider=kms_key_provider
    )
    return ciphertext

from aws_encryption_sdk import encrypt, decrypt
from aws_encryption_sdk.key_providers.kms import KMSMasterKeyProvider

kms_key_provider = KMSMasterKeyProvider(key_ids=['your-kms-key-id'])

def encrypt_data(plaintext, encryption_context=None):
    ciphertext, encryptor_header = encrypt(
        source=plaintext,
        key_provider=kms_key_provider,
        encryption_context=encryption_context
    )
    return ciphertext

@misc{vaitp:cve20208897,
  title        = {{Weak robustness vulnerability in AWS Encryption SDKs (Java, Python, C, JavaScript) < 2.0.0, due to non-committing property of AEAD ciphers}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-8897},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-8897/}}
}