The vulnerability resides in the caching layer of the AWS Encryption SDK for Python, where a shared key cache can be manipulated by an authenticated local threat actor to downgrade the cryptographic algorithm. This bypasses the SDK’s key commitment policy and allows the same ciphertext to be decrypted to multiple different plaintexts, effectively allowing information to be revealed or altered without the expected integrity guarantees.

The issue affects AWS Encryption SDK for Python in all releases prior to version 3.3.1 and prior to 4.0.5. Users of these versions exposed to the SDK’s shared key caching mechanism are at risk.

The CVSS score of 5.7 indicates a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitability requires local authentication with access to the shared key cache; an attacker can manipulate cached keys to achieve a cryptographic algorithm downgrade, enabling decryption of ciphertext to unintended plaintexts, thereby compromising confidentiality.