Threats tagged 'ghsa-v6xc-r9wm-438j'

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 have a vulnerability where key rotation is not enforced before reaching the NIST recommended usage limit for AES-GCM encryption keys with random nonces when AWS IAM encryption is enabled. This can lead to nonce reuse, increasing the risk of nonce collisions. An authorized consumer detecting such a collision could recover parts of plaintext from affected messages. Versions 1.1.2 and 1.2.1 address this issue by enforcing automatic key rotation before the usage limit is reached.