CVE-2020-8897 - CVE House
Back to Database
Status published Medium CVE-2020-8897

Robustness weakness in AWS KMS and Encryption SDKs

Vulnerability Description

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-8897

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Thai Duong

References

More from Amazon

View All →
CVE-2025-9039
Information Disclosure in Amazon ECS Container Agent
Medium 5.3
CVE-2025-8904
Privilege escalation issue in Amazon EMR Secret Agent component
Critical 9
CVE-2025-8217
Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension
Medium 5.1
CVE-2025-6031
Insecure device pairing in end of life Amazon Cloud Cam
High 7.7
CVE-2025-5688
Out of Bounds Write in FreeRTOS-Plus-TCP
High 7.5

Affected Vendor

Affected Software

AWS SDK
Vulnerable Versions:
stable

Timeline

Official Publish: November 16th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-310

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.