{"action":"Upgrade aws-encryption-sdk to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"aws-encryption-sdk","cve_ids":["CVE-2020-8897"],"ecosystem":"PyPI","epss":0.00399,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-wqgp-vphw-hphf","id":"tcs_01M5KGA3SHV89897NRFXP5WB83","modified_at":"2025-10-09T06:53:18.019386Z","published_at":"2020-11-16T12:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-261","https://aws.amazon.com/blogs/security/improved-client-side-encryption-explicit-keyids-and-key-commitment/","https://github.com/google/security-research/security/advisories/GHSA-wqgp-vphw-hphf"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-261","url":"https://osv.dev/vulnerability/PYSEC-2020-261"}],"summary":"A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such"}