CVE-2020-8911: aws/aws-sdk-go CBC padding oracle issue in AWS S3 Crypto SDK for golang
Summary
CVE-2020-8911: aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang. Affects github.com/aws/aws-sdk-go versions < 1.34.0. Fixed in 1.34.0. How to fix ↓
Also tracked for
The same CVE-2020-8911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The aws/aws-sdk-go package is a GoLang software development kit (SDK) provided by Amazon Web Services (AWS) for interacting with various AWS services. It allows users to build applications that utilize AWS services, including Amazon S3 for object storage. The vulnerability, known as a CBC padding oracle issue, affects versions prior to V2 of the AWS S3 Crypto SDK for GoLang.
Vulnerability Detail
The vulnerability arises from the AWS S3 Crypto SDK for GoLang's ability to encrypt files with AES-CBC without computing a Message Authentication Code (MAC). This allows an attacker with write access to the target's S3 bucket to observe whether an endpoint with access to the key can decrypt a file. By exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors, the attacker can reconstruct the plaintext with an average of 128 times the length of the plaintext queries to the endpoint. This vulnerability can lead to unauthorized access to sensitive data stored in AWS S3 buckets.
How To Fix
Minimum fixed version
1.34.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The aws/aws-sdk-go package prior to V2 is vulnerable to a CBC padding oracle issue in the AWS S3 Crypto SDK for GoLang. This vulnerability allows an attacker with write access to an S3 bucket to reconstruct encrypted file plaintext, potentially leading to unauthorized access to sensitive data. It is crucial to update to version 1.34.0 or later to mitigate this vulnerability.
See every vulnerability recorded for github.com/aws/aws-sdk-go →
FAQ
The vulnerability allows an attacker with write access to an S3 bucket to reconstruct the plaintext of encrypted files, potentially leading to unauthorized access to sensitive data.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 5.6, indicating a medium severity.
Yes, there are known exploits available for this vulnerability. You can find more information in the references section.
Yes, the vulnerability has been fixed in version 1.34.0 of the aws/aws-sdk-go package. It is recommended to update to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/aws/aws-sdk-go.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
