Homepage About Snyk

Use of a Broken or Risky Cryptographic Algorithm Affecting github.com/aws/aws-sdk-go/service/s3/s3crypto package, versions <1.34.2

0.0
medium

  • Exploit Maturity

    Proof of concept

  • Attack Complexity

    High

  • Privileges Required

    High

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-GOLANG-GITHUBCOMAWSAWSSDKGOSERVICES3S3CRYPTO-598253

  • published

    12 Aug 2020

  • disclosed

    12 Aug 2020

  • credit

    Sophie Schmieg

Report a new vulnerability Found a mistake?

Introduced: 12 Aug 2020

CVE-2020-8911 Open this link in a new tab
CWE-327 Open this link in a new tab

How to fix?

Upgrade github.com/aws/aws-sdk-go/service/s3/s3crypto to version 1.34.2 or higher.

Overview

github.com/aws/aws-sdk-go/service/s3/s3crypto is an AWS SDK for the Go programming language.

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

References