CBC padding oracle in AWS S3 Crypto SDK for GoLang
Published Aug 11, 2020
5.6
MEDIUMCVSS 3.1
EPSS 0.35%
Description
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.
Affected products
-
- Version stableStatusaffectedConstraints<=V1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Google LLC | AWS S3 Crypto SDK for GoLang | n/a |
|
- < 2.0
No data.
3scale API Management 2.11 on RHEL 7
3scale-amp2/3scale-rhel7-operator-metadata:2.11.0-16
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 7
3scale-amp2/3scale-rhel7-operator:1.14.0-4
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 7
3scale-amp2/apicast-rhel7-operator-metadata:2.11.0-9
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 7
3scale-amp2/apicast-rhel7-operator:1.14.0-3
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 7
3scale-amp2/memcached-rhel7:1.4.16-38
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 7
3scale-amp2/system-rhel7:1.15.0-8
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 8
3scale-amp2/apicast-gateway-rhel8:1.20.0-6
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 8
3scale-amp2/backend-rhel8:1.14.0-3
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 8
3scale-amp2/toolbox-rhel8:1.6.0-7
Fixed · RHSA-2021:3851
3scale API Management 2.11 on RHEL 8
3scale-amp2/zync-rhel8:1.14.0-3
Fixed · RHSA-2021:3851
A-MQ Interconnect 1
amq-cert-manager-container
Will not fix
OpenShift Serverless
cli
Will not fix
OpenShift Serverless
knative-eventing
Will not fix
OpenShift Serverless
knative-serving
Will not fix
OpenShift Service Mesh 1
servicemesh
Not affected
OpenShift Service Mesh 1
servicemesh-grafana
Not affected
OpenShift Service Mesh 1
servicemesh-operator
Not affected
OpenShift Service Mesh 1
servicemesh-prometheus
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
awk-sdk-go
Not affected
Red Hat Ceph Storage 2
grafana
Not affected
Red Hat Ceph Storage 3
grafana
Not affected
Red Hat Ceph Storage 4
rhceph/rhceph-4-dashboard-rhel8
Not affected
Red Hat Cluster Application Migration
rhmtc/openshift-migration-controller-rhel8
Not affected
Red Hat Cluster Application Migration
rhmtc/openshift-migration-registry-rhel8
Not affected
Red Hat Cluster Application Migration
rhmtc/openshift-migration-velero-plugin-for-aws-rhel8
Not affected
Red Hat Cluster Application Migration
rhmtc/openshift-migration-velero-restic-restore-helper-rhel8
Not affected
Red Hat Cluster Application Migration
rhmtc/openshift-migration-velero-rhel8
Not affected
Red Hat Fuse 7
dv-operator-container
Will not fix
Red Hat Integration Service Registry
integration-service-registry-operator-container
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift-cluster-autoscaler
Not affected
Red Hat OpenShift Container Platform 3.11
golang-github-prometheus-prometheus
Not affected
Red Hat OpenShift Container Platform 3.11
openshift3/grafana
Not affected
Red Hat OpenShift Container Platform 4
openshift
Not affected
Red Hat OpenShift Container Platform 4
openshift-clients
Not affected
Red Hat OpenShift Container Platform 4
openshift-enterprise-node-container
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-aws-ebs-csi-driver-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-aws-machine-controllers
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-baremetal-installer-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cli
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cli-artifacts
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-autoscaler
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-image-registry-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-ingress-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-coredns
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-efs-provisioner-rhel7
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-grafana
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-hyperkube
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer-artifacts-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-kube-etcd-signer-server
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-ansible-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-helm-container-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-reporting-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-prometheus-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-thanos-rhel8
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-vertical-pod-autoscaler-rhel8
Not affected
Red Hat Openshift Container Storage 4
mcg
Not affected
Red Hat Openshift Container Storage 4
ocs4/mcg-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/rook-ceph-rhel8-operator
Not affected
Red Hat Storage 3
grafana
Not affected
Red Hat Storage 3
multi-cloud-object-gateway-cli
Not affected
Red Hat Storage 3
noobaa-operator-container
Not affected
Red Hat Storage 3
rhgs3/rhgs-gluster-block-prov-rhel7
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| 3scale API Management 2.11 on RHEL 7 | 3scale-amp2/3scale-rhel7-operator-metadata:2.11.0-16 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 7 | 3scale-amp2/3scale-rhel7-operator:1.14.0-4 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 7 | 3scale-amp2/apicast-rhel7-operator-metadata:2.11.0-9 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 7 | 3scale-amp2/apicast-rhel7-operator:1.14.0-3 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 7 | 3scale-amp2/memcached-rhel7:1.4.16-38 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 7 | 3scale-amp2/system-rhel7:1.15.0-8 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 8 | 3scale-amp2/apicast-gateway-rhel8:1.20.0-6 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 8 | 3scale-amp2/backend-rhel8:1.14.0-3 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 8 | 3scale-amp2/toolbox-rhel8:1.6.0-7 | Fixed | RHSA-2021:3851 |
| 3scale API Management 2.11 on RHEL 8 | 3scale-amp2/zync-rhel8:1.14.0-3 | Fixed | RHSA-2021:3851 |
| A-MQ Interconnect 1 | amq-cert-manager-container | Will not fix | n/a |
| OpenShift Serverless | cli | Will not fix | n/a |
| OpenShift Serverless | knative-eventing | Will not fix | n/a |
| OpenShift Serverless | knative-serving | Will not fix | n/a |
| OpenShift Service Mesh 1 | servicemesh | Not affected | n/a |
| OpenShift Service Mesh 1 | servicemesh-grafana | Not affected | n/a |
| OpenShift Service Mesh 1 | servicemesh-operator | Not affected | n/a |
| OpenShift Service Mesh 1 | servicemesh-prometheus | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | awk-sdk-go | Not affected | n/a |
| Red Hat Ceph Storage 2 | grafana | Not affected | n/a |
| Red Hat Ceph Storage 3 | grafana | Not affected | n/a |
| Red Hat Ceph Storage 4 | rhceph/rhceph-4-dashboard-rhel8 | Not affected | n/a |
| Red Hat Cluster Application Migration | rhmtc/openshift-migration-controller-rhel8 | Not affected | n/a |
| Red Hat Cluster Application Migration | rhmtc/openshift-migration-registry-rhel8 | Not affected | n/a |
| Red Hat Cluster Application Migration | rhmtc/openshift-migration-velero-plugin-for-aws-rhel8 | Not affected | n/a |
| Red Hat Cluster Application Migration | rhmtc/openshift-migration-velero-restic-restore-helper-rhel8 | Not affected | n/a |
| Red Hat Cluster Application Migration | rhmtc/openshift-migration-velero-rhel8 | Not affected | n/a |
| Red Hat Fuse 7 | dv-operator-container | Will not fix | n/a |
| Red Hat Integration Service Registry | integration-service-registry-operator-container | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-cluster-autoscaler | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | golang-github-prometheus-prometheus | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/grafana | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-clients | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-enterprise-node-container | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-aws-ebs-csi-driver-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-aws-machine-controllers | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-installer-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cli | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cli-artifacts | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-autoscaler | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-image-registry-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-ingress-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-coredns | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-efs-provisioner-rhel7 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-grafana | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-hyperkube | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer-artifacts-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-kube-etcd-signer-server | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-ansible-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-helm-container-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-reporting-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-prometheus-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-thanos-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-vertical-pod-autoscaler-rhel8 | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | mcg | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/mcg-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/rook-ceph-rhel8-operator | Not affected | n/a |
| Red Hat Storage 3 | grafana | Not affected | n/a |
| Red Hat Storage 3 | multi-cloud-object-gateway-cli | Not affected | n/a |
| Red Hat Storage 3 | noobaa-operator-container | Not affected | n/a |
| Red Hat Storage 3 | rhgs3/rhgs-gluster-block-prov-rhel7 | Not affected | n/a |
github.com/aws/aws-sdk-go
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/aws/aws-sdk-go | 0 | not fixed |
Remediation
Red Hat statement
The following products include components that use the AWS SDK (aws/aws-sdk-go), however they do not include code that encrypts or decrypts files in S3 buckets (aws/aws-sdk-go/service/s3/s3crypto). The below products are not affected by this flaw: * Red Hat Cluster Application Migration * Red Hat OpenShift Container Platform * Red Hat OpenShift ServiceMesh * Red Hat OpenShift Container Storage * Red Hat Ceph Storage * Red Hat Gluster Storage
References (13)
- https://access.redhat.com/security/cve/CVE-2020-8911 Vendor Advisory
- https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09 x_refsource_CONFIRMVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1869800 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0971 Advisory
- https://github.com/advisories/GHSA-f5pg-7wfw-84q9 Advisory
- https://github.com/aws/aws-sdk-go/commit/1e84382fa1c0086362b5a4b68e068d4f8518d40e
- https://github.com/aws/aws-sdk-go/commit/ae9b9fd92af132cfd8d879809d8611825ba135f4
- https://github.com/aws/aws-sdk-go/pull/3403
- https://github.com/google/security-research/security/advisories/GHSA-f5pg-7wfw-84q9 x_refsource_CONFIRMExploitThird Party Advisory
- https://github.com/sophieschmieg/exploits/tree/master/aws_s3_crypto_poc
- https://nvd.nist.gov/vuln/detail/CVE-2020-8911
- https://pkg.go.dev/vuln/GO-2022-0646
- https://www.cve.org/CVERecord?id=CVE-2020-8911
Change history (0)
No recorded changes yet.