GHSA-w736-hf9p-qqh3: 
Java vulnerability analysis and mitigation

A low severity vulnerability (GHSA-w736-hf9p-qqh3) was identified in the DynamoDB Encryption Client's MostRecentProvider component, affecting versions prior to 1.15.0. The vulnerability was discovered and disclosed on February 4, 2021, impacting the aws-dynamodb-encryption-java package. The issue specifically affects implementations using MostRecentProvider in conjunction with key providers like AWS Key Management Service that support modifiable key permissions (GitHub Advisory).

The vulnerability stems from a flaw in the time-based key reauthorization logic within MostRecentProvider. When key usage permissions were modified at the key provider level, the MostRecentProvider failed to properly reauthorize the key usage. This created a security gap where keys could potentially continue to be used in the DynamoDB Encryption Client even after their permissions had been revoked at the key provider level (GitHub Advisory, AWS Changelog).

The vulnerability could allow continued use of cryptographic keys in the DynamoDB Encryption Client after their permissions had been explicitly revoked at the key provider level. This could potentially lead to unauthorized access to encrypted data or bypass of intended access restrictions (GitHub Advisory).

The vulnerability requires specific conditions to be exploited, including the use of MostRecentProvider with a key provider that supports modifiable key permissions, such as AWS Key Management Service. The severity is rated as Low, suggesting limited real-world exploitability (GitHub Advisory).

The vulnerability was patched in version 1.15.0 with the introduction of CachingMostRecentProvider, which replaces the deprecated MostRecentProvider. Users are strongly recommended to upgrade to version 1.15.0 or later and modify their code to use CachingMostRecentProvider. For users unable to upgrade immediately, a temporary workaround is available by calling clear() on the cache to manually flush its contents, which forces re-validation of the key with the key provider on next use (GitHub Advisory).