漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
Vulnerability Description
Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Vulnerability Type
在会话协商时选择低安全性的算法(算法降级)
Vulnerability Title
Amazon AWS Encryption SDK 安全漏洞
Vulnerability Description
Amazon AWS Encryption SDK是美国亚马逊（Amazon）公司的一个应用于加密的开发工具包。 Amazon AWS Encryption SDK 3.3.1之前版本和4.0.5之前版本存在安全漏洞，该漏洞源于加密算法降级问题，可能导致经过身份验证的本地威胁参与者绕过密钥承诺策略执行。
CVSS Information
N/A
Vulnerability Type
N/A