Advisoriesby Ibiss2n-tls could negotiate signature algorithms not allowed by policy
Impact
s2n-tls clients and servers negotiating TLS1.2 could choose a SHA-1 hash in TLS connection signatures despite their s2n-tls security policy not supporting SHA-1.
Customers of AWS services do not need to take action. Applications using s2n-tls should upgrade to the most recent release of s2n-tls.
Patches
The patch is included in s2n-tls v1.3.54
Workarounds
There is no workaround. Applications using s2n-tls should upgrade to the most recent release of s2n-tls.
If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| s2n-tls Product | < 1.3.54 | 1.3.54 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More AWS advisories
All AWS
GHSA for sagemaker.base_deserializers.NumpyDeserializerCVE-2024-34072fixed in 2.218.0Potential URI resolution path traversal in the AWS SDK for PHPCVE-2023-51651fixed in 3.288.1Potential denial of service via crafted stream framesGHSA-475v-pq2g-fp9gfixed in v1.31.0Potential denial of service after connection migrationGHSA-rfhg-rjfp-9q8qfixed in v1.25.0Potential denial of service when receiving empty UDP packetsGHSA-hxq4-mx37-fqvgfixed in v1.23.0EKS overly permissive trust policiesCVE-2023-35165fixed in 2.80.0 +1