Vulnerability Details : CVE-2022-2582
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
Exploit prediction scoring system (EPSS) score for CVE-2022-2582
Probability of exploitation activity in the next 30 days: 0.05%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 18 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2022-2582
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2022-2582
-
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-2582
-
https://pkg.go.dev/vuln/GO-2022-0391
GO-2022-0391 - Go PackagesExploit;Patch;Third Party Advisory
-
https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1
service/s3/s3crypto: V2 Client Release (#3403) · aws/aws-sdk-go@35fa6dd · GitHubPatch;Third Party Advisory
Products affected by CVE-2022-2582
- cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:go:*:*