Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ4d3AtbTdtcS03cTNy
CLI does not correctly implement strict mode
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode."
Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.
Permalink: https://github.com/advisories/GHSA-2xwp-m7mq-7q3rJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ4d3AtbTdtcS03cTNy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 3 years ago
Updated: 9 months ago
Identifiers: GHSA-2xwp-m7mq-7q3r
References:
- https://github.com/aws/aws-encryption-sdk-cli/security/advisories/GHSA-2xwp-m7mq-7q3r
- https://github.com/aws/aws-encryption-sdk-cli/commit/7d21b8051cab9e52e056fe427d2bff19cf146460
- https://github.com/advisories/GHSA-2xwp-m7mq-7q3r
Affected Packages
pypi:aws-encryption-sdk-cli
Versions: >= 2.0.0, < 2.1.0, < 1.8.0Fixed in: 2.1.0, 1.8.0