CVE-2024-23680

MediumCVSS 5.3

Published: 19/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and versions earlier than 1.9.0 incorrectly validate some invalid ECDSA signatures. This could lead to acceptance of forged signatures.

Risk Assessment

The risk is that the data authentication mechanism can be bypassed, potentially allowing an attacker to impersonate a trusted source or modify encrypted data without detection.

Recommendation

It is recommended to immediately update AWS Encryption SDK for Java to version 2.2.1 or later (for 2.x line) and to version 1.9.0 or later (for 1.x line).

Original NVD description (English source)

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.