Search

Find a vulnerability

Search criteria

    1 vulnerability by github.com/aws/aws-sdk-go

    CVE-2022-2582 (GCVE-0-2022-2582)

    Vulnerability from cvelistv5 – Published: 2022-12-27 21:13 – Updated: 2025-04-11 16:20
    VLAI
    Title
    Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
    Summary
    The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE 311: Missing Encryption of Sensitive Data
    Assigner
    Go
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:39:08.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0391"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-2582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-11T16:19:30.823999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-11T16:20:04.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/aws/aws-sdk-go/service/s3/s3crypto",
          "product": "github.com/aws/aws-sdk-go/service/s3/s3crypto",
          "programRoutines": [
            {
              "name": "encodeMeta"
            },
            {
              "name": "DecryptionClient.GetObject"
            },
            {
              "name": "DecryptionClient.GetObjectWithContext"
            },
            {
              "name": "EncryptionClient.PutObject"
            },
            {
              "name": "EncryptionClient.PutObjectWithContext"
            },
            {
              "name": "S3LoadStrategy.Load"
            },
            {
              "name": "S3SaveStrategy.Save"
            },
            {
              "name": "defaultV2LoadStrategy.Load"
            },
            {
              "name": "kmsKeyHandler.DecryptKey"
            },
            {
              "name": "kmsKeyHandler.DecryptKeyWithContext"
            },
            {
              "name": "kmsKeyHandler.GenerateCipherData"
            },
            {
              "name": "kmsKeyHandler.GenerateCipherDataWithContext"
            }
          ],
          "vendor": "github.com/aws/aws-sdk-go",
          "versions": [
            {
              "lessThan": "1.34.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 311: Missing Encryption of Sensitive Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:12.778Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0391"
        }
      ],
      "title": "Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-2582",
    "datePublished": "2022-12-27T21:13:47.272Z",
    "dateReserved": "2022-07-29T19:42:31.027Z",
    "dateUpdated": "2025-04-11T16:20:04.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}