Vulnerability Report: GO-2022-0646
- CVE-2020-8911, CVE-2020-8912, and 2 more
- Affects: github.com/aws/aws-sdk-go
- Published: Feb 11, 2022
- Modified: May 20, 2024
The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client.
For detailed information about this vulnerability, visit https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09.
Affected Packages
-
PathVersionsSymbols
-
all versions, no known fixed
Aliases
References
- https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09
- https://github.com/aws/aws-sdk-go/pull/3403
- https://github.com/aws/aws-sdk-go/commit/ae9b9fd92af132cfd8d879809d8611825ba135f4
- https://vuln.go.dev/ID/GO-2022-0646.json
Credits
- Sophie Schmieg from the Google ISE team
Feedback
See anything missing or incorrect?
Suggest an edit to this report.