GHSA-4ph2-8337-hm62: 
Python vulnerability analysis and mitigation

The vulnerability (GHSA-4ph2-8337-hm62) affects the DynamoDB Encryption Client's MostRecentProvider component when used with key providers like AWS Key Management Service. The issue was discovered and disclosed on February 4, 2021, affecting versions below 1.3.0 of the dynamodb-encryption-sdk Python package. The vulnerability was assigned a low severity rating (GitHub Advisory).

The vulnerability stems from a flaw in the time-based key reauthorization logic within MostRecentProvider. When key usage permissions were modified at the key provider level, the MostRecentProvider failed to reauthorize the use of the key, potentially allowing continued use of revoked keys. The issue is classified under CWE-862 (Missing Authorization) and has been assigned a low severity rating (GitHub Advisory, AWS Changelog).

The vulnerability could allow the continued use of cryptographic keys in the DynamoDB Encryption Client even after their permissions had been revoked at the key provider level. This particularly affects scenarios where AWS Key Management Service or similar key providers are used where key permissions can be modified (GitHub Advisory).

While specific exploit details are not publicly available, the vulnerability requires access to a system using MostRecentProvider with a key provider that allows for permissions modification on keys. The issue is primarily a security control bypass rather than an active exploit vector (GitHub Advisory).

The vulnerability was patched in version 1.3.0 with the introduction of CachingMostRecentProvider, which replaces the deprecated MostRecentProvider. Users are recommended to upgrade to version 1.3.0 or later and modify their code to use CachingMostRecentProvider. For users unable to upgrade immediately, a temporary workaround is available by calling clear() on the cache to manually flush its contents, forcing re-validation with the key provider on next use (GitHub Advisory, AWS Changelog).