A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.
Published 2020-08-11 20:15:13
Updated 2020-08-17 19:31:43
Source Google Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-8912

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 11 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2020-8912

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
2.1
LOW AV:L/AC:L/Au:N/C:P/I:N/A:N
3.9
2.9
NIST
2.5
LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
1.0
1.4
Google Inc.
2.5
LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
1.0
1.4
NIST

CWE ids for CVE-2020-8912

References for CVE-2020-8912

Products affected by CVE-2020-8912

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!