Executive brief
The AWS Encryption SDK for Python is a library used by developers to encrypt and decrypt data within their applications. A vulnerability in how the library handles cached encryption keys could allow a local user to bypass security policies intended to ensure a single ciphertext only corresponds to a single original message. This could lead to a situation where different users see different data when decrypting the same encrypted file, potentially compromising data integrity and trust.
Technical details
A cryptographic algorithm downgrade vulnerability exists in the caching layer of the AWS Encryption SDK (ESDK) for Python. When multiple instances of the ESDK share a key cache but have different key commitment policies, the library may fail to enforce the stricter policy. This allows an authenticated local threat actor to bypass key commitment enforcement, leading to a 'key commitment' failure where a single ciphertext can be decrypted into multiple different plaintexts depending on the key used. The issue is resolved in versions 3.3.1 and 4.0.5. Users who cannot upgrade should avoid sharing key caches between ESDK instances with different security policies.
Affected products
- AWS Encryption SDK for Python 2.0 - 2.5.1, 3.0 - 3.3.0, 4.0 - 4.0.4
Timeline
- 2026-04-20: disclosed
- 2026-04-20: advisory