GHSA-4ph2-8337-hm62
Key Caching behavior in the DynamoDB Encryption Client.
Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.
When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.
Patches
Fixed as of 1.3.0. We recommend users to modify their code and adopt CachingMostRecentProvider.
Workarounds
Users who cannot upgrade to use the CachingMostRecentProvider can call clear() on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
What each source reports
GitHub AdvisoriesNo score
Key Caching behavior in the DynamoDB Encryption Client.
Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.
When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.
Patches
Fixed as of 1.3.0. We recommend users to modify their code and adopt CachingMostRecentProvider.
Workarounds
Users who cannot upgrade to use the CachingMostRecentProvider can call clear() on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
- Record
GHSA-4ph2-8337-hm62- Weakness
- CWE-862
- Updated
- 2026-11-02
OSVNo score
Key Caching behavior in the DynamoDB Encryption Client.
Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.
When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.
Patches
Fixed as of 1.3.0. We recommend users to modify their code and adopt CachingMostRecentProvider.
Workarounds
Users who cannot upgrade to use the CachingMostRecentProvider can call clear() on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
- Record
GHSA-4ph2-8337-hm62- Weakness
- CWE-862
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dynamodb-encryption-sdkPyPI | before 1.3.0 | 1.3.0 |
dynamodb-encryption-sdkPyPI | before 1.3.0, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 6 moreShow less1.0.51.0.61.0.71.1.01.1.11.2.0 | 1.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4ph2-8337-hm62 is a vulnerability with no CVSS score yet in dynamodb-encryption-sdk, published February 8, 2021. No source lists public exploit code. Fixed in dynamodb-encryption-sdk 1.3.0.
References
github.com/aws/aws-dynamodb-encryption-python/security/advisories/GHSA-4ph2-8337-hm62
pypi.org/project/dynamodb-encryption-sdk