PT-2022-17545 · Amazon Web Services · Aws S3 Crypto Sdk

Published 2022-02-11 · Updated 2023-01-05 · CVE-2022-2582

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AWS S3 Crypto SDK (affected versions not specified)

Description The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. The issue poses insider risks and privilege escalation risks, circumventing KMS controls for stored data. The attack is theoretically valid if the plaintext entropy is below the key size. The issue has been fully mitigated by AWS as of Aug. 5th by disallowing the header in question.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2022-2582

GHSA-6JVC-Q2X7-PCHV

GHSA-76WF-9VGP-PJ7W

GO-2022-0391

Affected Products

Aws S3 Crypto Sdk

References · 17

• 🔥 https://pkg.go.dev/vuln/GO-2022-0391 · Exploit
• https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-2582 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jvc-q2x7-pchv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2582 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2582 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0391 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2582 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2582 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2582 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-76wf-9vgp-pj7w · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2582 · Vendor Advisory
• https://github.com/aws/aws-sdk-go · Note
• https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w · Note
• https://t.me/cvenotify/40824 · Telegram Post