{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.amazonaws:aws-encryption-sdk-java","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"2.2.0","status":"affected","version":"2.0.0","versionType":"maven"},{"lessThan":"1.9.0","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.amazonaws:aws-encryption-sdk-java","product":"com.amazonaws:aws-encryption-sdk-java","source":"OSV GHSA-55xh-53m6-936r","vendor":"","versions":[{"status":"affected","version":"0.0.1","versionType":"Maven"},{"status":"affected","version":"1.3.0","versionType":"Maven"},{"status":"affected","version":"1.3.1","versionType":"Maven"},{"status":"affected","version":"1.3.1-STAGING","versionType":"Maven"},{"status":"affected","version":"1.3.2","versionType":"Maven"},{"status":"affected","version":"1.3.3","versionType":"Maven"},{"status":"affected","version":"1.3.4","versionType":"Maven"},{"status":"affected","version":"1.3.5","versionType":"Maven"},{"status":"affected","version":"1.3.6","versionType":"Maven"},{"status":"affected","version":"1.4.0","versionType":"Maven"},{"status":"affected","version":"1.4.1","versionType":"Maven"},{"status":"affected","version":"1.5.0","versionType":"Maven"},{"status":"affected","version":"1.6.0","versionType":"Maven"},{"status":"affected","version":"1.6.1","versionType":"Maven"},{"status":"affected","version":"1.6.2","versionType":"Maven"},{"status":"affected","version":"1.7.0","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"1.9.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.amazonaws:aws-encryption-sdk-java","product":"com.amazonaws:aws-encryption-sdk-java","source":"OSV GHSA-55xh-53m6-936r","vendor":"","versions":[{"status":"affected","version":"2.0.0","versionType":"Maven"},{"events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}],"status":"unknown","version":"2.0.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23680","cwes":["CWE-347"],"description":"AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.","epss":{"date":"2026-11-08","percentile":0.1132,"score":0.0021},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794146397637,"publishedAt":1705697074957,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-55xh-53m6-936r"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-55xh-53m6-936r"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-55xh-53m6-936r"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-55xh-53m6-936r"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-55xh-53m6-936r"}],"remediation":[{"kind":"fix","source":"OSV GHSA-55xh-53m6-936r","text":"com.amazonaws:aws-encryption-sdk-java (Maven): OSV reports a fixed version 1.9.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-55xh-53m6-936r"},{"kind":"fix","source":"OSV GHSA-55xh-53m6-936r","text":"com.amazonaws:aws-encryption-sdk-java (Maven): OSV reports a fixed version 2.2.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-55xh-53m6-936r"}],"revision":"c4b2541b4f92227a857ddf6420be990bbbf474ae8cf471d7928e7b33b8bc68d1","sources":[{"modifiedAt":1794146397637,"name":"CNA: VulnCheck","retrievedAt":1794146930228,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23680"},{"modifiedAt":1783493589334,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146930606,"url":"https://osv.dev/vulnerability/GHSA-55xh-53m6-936r"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150558911,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23680"}],"ssvc":{"assessedAt":1725999324864,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"AWS Encryption SDK for Java Improper Verification of Cryptographic Signature","updatedAt":1794150558911}