Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

Description

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages.

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated.

Recommendation

Update the @aws-crypto/client-browser package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.0, < 2.2.0

  < 1.9.0**

• Patched version(s): **2.2.0

  1.9.0**

References

• GHSA-h45p-w933-jxh3
• CWE-347
• OWASP 2021-A2