Vulnerability Details : CVE-2022-2582
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
Products affected by CVE-2022-2582
- cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:go:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-2582
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 22 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-2582
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2022-2582
-
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-2582
-
https://pkg.go.dev/vuln/GO-2022-0391
GO-2022-0391 - Go PackagesExploit;Patch;Third Party Advisory
-
https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1
service/s3/s3crypto: V2 Client Release (#3403) · aws/aws-sdk-go@35fa6dd · GitHubPatch;Third Party Advisory
Jump to