Skip to content

Commit 9fce0a8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-27qh-8cxx-2cr5 GHSA-m959-cc7f-wv43
1 parent 3fd7de5 commit 9fce0a8

2 files changed

Lines changed: 125 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-27qh-8cxx-2cr5/GHSA-27qh-8cxx-2cr5.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27qh-8cxx-2cr5",
4+
"modified": "2026-03-27T19:54:59Z",
5+
"published": "2026-03-27T19:54:58Z",
6+
"aliases": [],
7+
"summary": "AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters",
8+
"details": "### Summary\n\nThis notification is related to the [CloudFront signing utilities](https://github.com/aws/aws-sdk-php/blob/master/src/CloudFront/Signer.php) in the AWS SDK for PHP, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and backslashes, in input values.\n\n### Impact\n\nThe CloudFront signing utilities build policy documents that define access restrictions for signed URLs and cookies. If an application passes unsanitized input containing special characters to these utilities, the resulting policy document may not reflect the application's intended access restrictions. While the SDK was functioning safely within the requirements of the shared responsibility model, additional safeguards have been added to support secure customer implementations. Applications that already follow AWS security best practices for input validation are not impacted.\n\n### Impacted versions: 3.11.7 - 3.371.3\n\n### Patches\n\nOn 3/3/2026, an enhancement was made to the AWS SDK for PHP version 3.371.4. The enhancement ensures that special characters in input values are correctly handled. It is recommended to upgrade to the latest version.\n\n### Workarounds\n\nNo workarounds are needed, but customers should ensure that the application is following security best practices:\n\n- Implement proper input validation in application code before passing values to CloudFront signing utilities\n- Update to the latest AWS SDK release on a regular basis\n- Follow AWS security best practices for SDK configuration\n\n### References\n\nFor any questions or comments about this advisory, it is recommended to contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n### Acknowledgement\n\nThe Amazon Inspector Security Research team is thanked for identifying this issue and working through the coordinated process.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "aws/aws-sdk-php"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "3.11.7"
27+
},
28+
{
29+
"fixed": "3.371.4"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.371.3"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/aws/aws-sdk-php/security/advisories/GHSA-27qh-8cxx-2cr5"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/aws/aws-sdk-php"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/aws/aws-sdk-php/blob/master/src/CloudFront/Signer.php"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/aws/aws-sdk-php/releases/tag/3.371.4"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-150",
60+
"CWE-20",
61+
"CWE-74"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-27T19:54:58Z",
66+
"nvd_published_at": null
67+
}
68+
}

‎advisories/github-reviewed/2026/03/GHSA-m959-cc7f-wv43/GHSA-m959-cc7f-wv43.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m959-cc7f-wv43",
4+
"modified": "2026-03-27T19:56:21Z",
5+
"published": "2026-03-27T19:56:21Z",
6+
"aliases": [
7+
"CVE-2026-34073"
8+
],
9+
"summary": "cryptography has incomplete DNS name constraint enforcement on peer names",
10+
"details": "## Summary\n\nIn versions of cryptography prior to 46.0.5, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named `bar.example.com` to validate against a wildcard leaf certificate for `*.example.com`, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for `bar.example.com`.\n\nThis behavior resulted from a gap between RFC 5280 (which defines Name Constraint semantics) and RFC 9525 (which defines service identity semantics): put together, neither states definitively whether Name Constraints should be applied to peer names. To close this gap, cryptography now conservatively rejects any validation where the peer name would be rejected by a name constraint if it were a SAN instead.\n\nIn practice, exploitation of this bypass requires an uncommon X.509 topology, one that the Web PKI avoids because it exhibits these kinds of problems. Consequently, we consider this a medium-to-low impact severity.\n\nSee CVE-2025-61727 for a similar bypass in Go's `crypto/x509`.\n\n## Remediation\n\nUsers should upgrade to 46.0.6 or newer. \n\n## Attribution\n\nReporter: @1seal",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "cryptography"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "46.0.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/pyca/cryptography"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-295"
51+
],
52+
"severity": "LOW",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-27T19:56:21Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)