GHSA-2xwp-m7mq-7q3r
CLI does not correctly implement strict mode
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode."
Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.
What each source reports
GitHub AdvisoriesNo score
CLI does not correctly implement strict mode
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode."
Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.
- Record
GHSA-2xwp-m7mq-7q3r- Weakness
- CWE-326
- Updated
- 2026-11-02
OSVNo score
CLI does not correctly implement strict mode
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode."
Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.
- Record
GHSA-2xwp-m7mq-7q3r- Weakness
- CWE-326
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aws-encryption-sdk-cliPyPI | before 1.8.0 | 1.8.0 |
aws-encryption-sdk-cliPyPI | 2.0.0 up to 2.1.0 | 2.1.0 |
aws-encryption-sdk-cliPyPI | before 1.8.0, plus listed versions 1.1.01.1.11.1.21.1.31.1.4 Show 4 moreShow less1.1.51.1.61.1.71.7.0 | 1.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2xwp-m7mq-7q3r is a vulnerability with no CVSS score yet in aws-encryption-sdk-cli, published October 28, 2020. No source lists public exploit code. Fixed in aws-encryption-sdk-cli 1.8.0.