AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Aws_encryption_sdk | Amazon | * | 1.9.0 (excluding) |
| Aws_encryption_sdk | Amazon | 2.0.0 (including) | 2.2.0 (excluding) |