Is there a fix for GHSA-72FP-W44G-625Q?

Yes. GHSA-72FP-W44G-625Q is fixed in 3.1.1. Upgrade to this version or later.

Is GHSA-72FP-W44G-625Q exploitable, and should I be worried?

Whether GHSA-72FP-W44G-625Q is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-72FP-W44G-625Q is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-72FP-W44G-625Q

Q: What is GHSA-72FP-W44G-625Q?

GHSA-72FP-W44G-625Q is a low-severity security vulnerability in software.amazon.cryptography:aws-database-encryption-sdk-dynamodb (maven), affecting versions >= 3.0.0, < 3.1.1. It is fixed in 3.1.1.

Q: How do I fix GHSA-72FP-W44G-625Q?

Upgrade software.amazon.cryptography:aws-database-encryption-sdk-dynamodb to 3.1.1 or later.

Summary

Signing DynamoDB Sets when using the AWS Database Encryption SDK.

Workarounds

None

References

For more information on how to address records with Sets marked as SIGN_ONLY written by versions 3.1.0 and below of DB-ESDK, see AWS Database Encryption SDK Decrypt with Permute

Impact

This advisory addresses an issue when a DynamoDB Set attribute is marked as SIGN_ONLY in the AWS Database Encryption SDK (DB-ESDK) for DynamoDB. This also includes when a Set is part of a List or a Map.

DB-ESDK for DynamoDB supports SIGN_ONLY and ENCRYPT_AND_SIGN attribute actions. In version 3.1.0 and below, when a Set type is assigned a SIGN_ONLY attribute action, there is a chance that signature validation of the record containing a Set will fail on read, even if the Set attributes contain the same values. The probability of a failure depends on the order of the elements in the Set combined with how DynamoDB returns this data, which is undefined.

This update addresses the issue by ensuring that any Set values are canonicalized in the same order while written to DynamoDB as when read back from DynamoDB.

Affected versions

software.amazon.cryptography:aws-database-encryption-sdk-dynamodb (>= 3.0.0, < 3.1.1)

Security releases

software.amazon.cryptography:aws-database-encryption-sdk-dynamodb → 3.1.1 (maven)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Fixed in version 3.1.1
We recommend all users upgrade as soon as possible.

Frequently Asked Questions

What is GHSA-72FP-W44G-625Q? GHSA-72FP-W44G-625Q is a low-severity security vulnerability in software.amazon.cryptography:aws-database-encryption-sdk-dynamodb (maven), affecting versions >= 3.0.0, < 3.1.1. It is fixed in 3.1.1.
Which versions of software.amazon.cryptography:aws-database-encryption-sdk-dynamodb are affected by GHSA-72FP-W44G-625Q? software.amazon.cryptography:aws-database-encryption-sdk-dynamodb (maven) versions >= 3.0.0, < 3.1.1 is affected.
Is there a fix for GHSA-72FP-W44G-625Q? Yes. GHSA-72FP-W44G-625Q is fixed in 3.1.1. Upgrade to this version or later.
Is GHSA-72FP-W44G-625Q exploitable, and should I be worried? Whether GHSA-72FP-W44G-625Q is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-72FP-W44G-625Q is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-72FP-W44G-625Q? Upgrade software.amazon.cryptography:aws-database-encryption-sdk-dynamodb to 3.1.1 or later.