CVE-2022-2582: Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-2582?
CVE-2022-2582 is a vulnerability in the AWS S3 Crypto SDK that sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field.
What is the severity of CVE-2022-2582?
CVE-2022-2582 has a severity level of medium, with a CVSS score of 4.3.
Which versions of the AWS SDK are affected by CVE-2022-2582?
Versions up to and excluding 1.34.0 of the Amazon AWS Software Development Kit (SDK) are affected by CVE-2022-2582.
Has AWS addressed the vulnerability?
Yes, AWS has fixed the vulnerability and now blocks the metadata field that contains the unencrypted hash.
How can I fix CVE-2022-2582?
To fix CVE-2022-2582, update your AWS SDK to version 1.34.0 or later.