CLI does not correctly implement strict mode
Priority LOW 38CWE-326Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-326.
Summary
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode." Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.
Why it matters now
Fix Fixed aws-encryption-sdk-cli (PyPI): 1.8.0, 2.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | aws-encryption-sdk-cli (PyPI) | before 1.8.0 | 1.8.0 | Patch available | GHSA-2xwp-m7mq-7q3r |
| — | aws-encryption-sdk-cli (PyPI) | 2.0.0 to before 2.1.0 | 2.1.0 | Patch available | GHSA-2xwp-m7mq-7q3r |
- aws-encryption-sdk-cli (PyPI) Vendor— Affected before 1.8.0 Fixed in 1.8.0 Patch available GHSA-2xwp-m7mq-7q3r
- aws-encryption-sdk-cli (PyPI) Vendor— Affected 2.0.0 to before 2.1.0 Fixed in 2.1.0 Patch available GHSA-2xwp-m7mq-7q3r
Remediation
- Fix · GHSA-2xwp-m7mq-7q3r aws-encryption-sdk-cli (PyPI) Fixed in 1.8.0 Advisory →
- Fix · GHSA-2xwp-m7mq-7q3r aws-encryption-sdk-cli (PyPI) Fixed in 2.1.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-2xwp-m7mq-7q3r
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences