Use of a Broken or Risky Cryptographic Algorithm Affecting github.com/aws/aws-sdk-go/service/s3/s3crypto Open this link in a new tab package, versions <1.34.2
Exploit Maturity
Proof of concept
Attack Complexity
High
Privileges Required
High
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMAWSAWSSDKGOSERVICES3S3CRYPTO-598253
-
published
12 Aug 2020
-
disclosed
12 Aug 2020
-
credit
Sophie Schmieg
Introduced: 12 Aug 2020
CVE-2020-8911 Open this link in a new tabHow to fix?
Upgrade github.com/aws/aws-sdk-go/service/s3/s3crypto
to version 1.34.2 or higher.
Overview
github.com/aws/aws-sdk-go/service/s3/s3crypto is an AWS SDK for the Go programming language.
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.