| Package | Affected versions | Patched versions |
|---|---|---|
| aws-lc-fips-sys | ≥ 0.13.0, < 0.13.12 | 0.13.12 |
| aws-lc-sys | ≥ 0.14.0, < 0.38.0 | 0.38.0 |
| aws libcrypto | ≥ 1.21.0, < 1.69.0≥ 3.0.0, < 3.2.0 | 1.69.03.2.0 |
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free