https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:32:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292147 EUVD-2026-292147 https://cve.radiocsirt.org/vuln/euvd-2026-292147 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6550 <p>Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.</p> <p>To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.</p> <p>Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.</p> <p>To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6550 https://cve.radiocsirt.org/vuln/ghsa-v638-38fc-rhfv <p><strong>Affected:</strong> PyPI: aws-encryption-sdk</p> <p>## Summary AWS Encryption SDK (ESDK) for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.</p> <p>## Impact This issue requires all of the following conditions to be true: (1) Two ESDK for Python clients with different commitment policies share a single CachingCryptoMaterialsManager instance within the same process. (2) The client with the weaker commitment policy encrypts first, warming the cache. (3) Both clients use matching encryption contexts. (4) Both clients use the pre-configured default algorithm suite.</p> <p>These conditions may occur during a migration from ESDK for Python v1 to newer versions, as v1 did not support key commitment.</p> <p>When the weaker-policy client encrypts first, the cache stores encryption materials that do not enforce key commitment. Subsequent callers — including those configured to require key commitment — are served these cached materials instead of generating new ones that satisfy their policy. This results in encryption without key commitment, meaning the same ciphertext can be validly decrypted to different plaintexts under different keys (the &#34;Invisible Salamanders&#34; issue; see https://github.com/google/security-research/security/advisories/GHSA-wqgp…</p> <p><strong>Affected:</strong> PyPI: aws-encryption-sdk</p> <p>## Summary AWS Encryption SDK (ESDK) for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.</p> <p>## Impact This issue requires all of the following conditions to be true: (1) Two ESDK for Python clients with different commitment policies share a single CachingCryptoMaterialsManager instance within the same process. (2) The client with the weaker commitment policy encrypts first, warming the cache. (3) Both clients use matching encryption contexts. (4) Both clients use the pre-configured default algorithm suite.</p> <p>These conditions may occur during a migration from ESDK for Python v1 to newer versions, as v1 did not support key commitment.</p> <p>When the weaker-policy client encrypts first, the cache stores encryption materials that do not enforce key commitment. Subsequent callers — including those configured to require key commitment — are served these cached materials instead of generating new ones that satisfy their policy. This results in encryption without key commitment, meaning the same ciphertext can be validly decrypted to different plaintexts under different keys (the &#34;Invisible Salamanders&#34; issue; see https://github.com/google/security-research/security/advisories/GHSA-wqgp…</p> https://cve.radiocsirt.org/vuln/ghsa-v638-38fc-rhfv https://cve.radiocsirt.org/vuln/pysec-2026-2387 <p><strong>Affected:</strong> PyPI: aws-encryption-sdk</p> <p>## Summary AWS Encryption SDK (ESDK) for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.</p> <p>## Impact This issue requires all of the following conditions to be true: (1) Two ESDK for Python clients with different commitment policies share a single CachingCryptoMaterialsManager instance within the same process. (2) The client with the weaker commitment policy encrypts first, warming the cache. (3) Both clients use matching encryption contexts. (4) Both clients use the pre-configured default algorithm suite.</p> <p>These conditions may occur during a migration from ESDK for Python v1 to newer versions, as v1 did not support key commitment.</p> <p>When the weaker-policy client encrypts first, the cache stores encryption materials that do not enforce key commitment. Subsequent callers — including those configured to require key commitment — are served these cached materials instead of generating new ones that satisfy their policy. This results in encryption without key commitment, meaning the same ciphertext can be validly decrypted to different plaintexts under different keys (the &#34;Invisible Salamanders&#34; issue; see https://github.com/google/security-research/security/advisories/GHSA-wqgp…</p> <p><strong>Affected:</strong> PyPI: aws-encryption-sdk</p> <p>## Summary AWS Encryption SDK (ESDK) for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.</p> <p>## Impact This issue requires all of the following conditions to be true: (1) Two ESDK for Python clients with different commitment policies share a single CachingCryptoMaterialsManager instance within the same process. (2) The client with the weaker commitment policy encrypts first, warming the cache. (3) Both clients use matching encryption contexts. (4) Both clients use the pre-configured default algorithm suite.</p> <p>These conditions may occur during a migration from ESDK for Python v1 to newer versions, as v1 did not support key commitment.</p> <p>When the weaker-policy client encrypts first, the cache stores encryption materials that do not enforce key commitment. Subsequent callers — including those configured to require key commitment — are served these cached materials instead of generating new ones that satisfy their policy. This results in encryption without key commitment, meaning the same ciphertext can be validly decrypted to different plaintexts under different keys (the &#34;Invisible Salamanders&#34; issue; see https://github.com/google/security-research/security/advisories/GHSA-wqgp…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2387