CVE-2020-8912: In-band key negotiation issue in AWS S3 Crypto SDK for GoLang

Modified

AliasesCGA-234p-p2xx-xgr8CGA-25cr-9g26-q84wCGA-25w3-wfvj-c8v5+1052 more

Published 11-08-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-8912 is a low (CVSS 2.5) vulnerability in amazon aws_s3_crypto_sdk. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 2.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.5/10

010

Low · v3.1 (CVE.org)

EPSS score

0.23%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 3

OPENSUSE-SU-2024:14599-1 CGA-8GCV-7232-CV9C CGA-XRQ5-P686-839H

Timeline

11-08-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.12.5v2.02.1

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Security Research
Maturity: poc

Weaknesses

CWE · root cause

CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agentAll versions (No fix recorded)
amazon-ecs-agent-fipsAll versions (No fix recorded)
apply-cve-bumpAll versions (No fix recorded)

argo-cd-3.0< 3.0.23-r5
argo-cd-3.0-compat< 3.0.23-r5
argo-cd-3.1< 3.1.16-r3
argo-cd-3.1-compat< 3.1.16-r3
argo-cd-3.2All versions (No fix recorded)
argo-cd-3.2-compatAll versions (No fix recorded)
argo-cd-3.3All versions (No fix recorded)
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.23-r6
argo-cd-fips-3.0-compat< 3.0.23-r6
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-cd-fips-3.2All versions (No fix recorded)
argo-cd-fips-3.2-compatAll versions (No fix recorded)
argo-cd-fips-3.3All versions (No fix recorded)
argo-cd-fips-3.3-compatAll versions (No fix recorded)
argo-eventsAll versions (No fix recorded)
argo-events-fipsAll versions (No fix recorded)
argo-rolloutsAll versions (No fix recorded)
argo-rollouts-fipsAll versions (No fix recorded)
atlas-1.0All versions (No fix recorded)
atlas-1.0-fipsAll versions (No fix recorded)
atlas-1.1All versions (No fix recorded)
atlas-1.1-fipsAll versions (No fix recorded)
atlas-1.2All versions (No fix recorded)
aws-flb-cloudwatchAll versions (No fix recorded)
aws-flb-cloudwatch-fipsAll versions (No fix recorded)
aws-flb-firehoseAll versions (No fix recorded)
aws-flb-firehose-fipsAll versions (No fix recorded)
aws-flb-kinesisAll versions (No fix recorded)
aws-flb-kinesis-fipsAll versions (No fix recorded)
aws-node-termination-handlerAll versions (No fix recorded)
aws-node-termination-handler-fipsAll versions (No fix recorded)
aws-nukeAll versions (No fix recorded)
aws-nuke-fipsAll versions (No fix recorded)
aws-otel-collectorAll versions (No fix recorded)
aws-otel-collector-fipsAll versions (No fix recorded)
aws-s3-controllerAll versions (No fix recorded)
aws-sigv4-proxyAll versions (No fix recorded)
aws-sigv4-proxy-fipsAll versions (No fix recorded)
bank-vaultsAll versions (No fix recorded)
bank-vaults-fipsAll versions (No fix recorded)
bank-vaults-vault-operatorAll versions (No fix recorded)
bank-vaults-vault-operator-fipsAll versions (No fix recorded)
cadenceAll versions (No fix recorded)
cadence-cassandra-toolAll versions (No fix recorded)
cadence-fipsAll versions (No fix recorded)
cadence-fips-cassandra-toolAll versions (No fix recorded)
cadence-fips-serverAll versions (No fix recorded)
cadence-fips-sql-toolAll versions (No fix recorded)
cadence-serverAll versions (No fix recorded)
cadence-sql-toolAll versions (No fix recorded)
cephcsiAll versions (No fix recorded)
cephcsi-fipsAll versions (No fix recorded)
cert-exporterAll versions (No fix recorded)
cert-exporter-fipsAll versions (No fix recorded)
certificate-transparency-fips-trillian-ctserverAll versions (No fix recorded)
certificate-transparency-trillian-ctserverAll versions (No fix recorded)
cgAll versions (No fix recorded)
chartmuseumAll versions (No fix recorded)
chartmuseum-fipsAll versions (No fix recorded)
cloud-sql-proxy-2.16All versions (No fix recorded)
cloud-sql-proxy-2.17< 2.17.1-r21
cloud-sql-proxy-2.18All versions (No fix recorded)
cloud-sql-proxy-2.21All versions (No fix recorded)
cloud-sql-proxy-2.22All versions (No fix recorded)
cloud-sql-proxy-fipsAll versions (No fix recorded)
cloudbeat-9.0All versions (No fix recorded)
cloudbeat-fips-8.17All versions (No fix recorded)
cloudbeat-fips-9.0All versions (No fix recorded)
cluster-autoscaler-1.32< 1.32.7-r11
cluster-autoscaler-1.33All versions (No fix recorded)
cluster-autoscaler-1.34All versions (No fix recorded)
cluster-autoscaler-fips-1.32< 1.32.7-r9
cluster-autoscaler-fips-1.33All versions (No fix recorded)
cluster-autoscaler-fips-1.34All versions (No fix recorded)
commercial-grafana-11.6< 11.6.14-r0
commercial-grafana-12.1< 12.1.10-r0
commercial-grafana-12.2< 12.2.8-r0
commercial-grafana-12.3< 12.3.6-r0
commercial-grafana-12.4< 12.4.3-r0
commercial-grafana-13.0< 13.0.2-r1
consul-1.18< 1.18.2-r49
consul-1.19< 1.19.2-r49
consul-1.20< 1.20.6-r20
consul-1.21All versions (No fix recorded)
consul-fips-1.20< 1.20.6-r19
consul-fips-1.21All versions (No fix recorded)
consul-k8s-1.1All versions (No fix recorded)
consul-k8s-1.3All versions (No fix recorded)
consul-k8s-1.4All versions (No fix recorded)
consul-k8s-1.5All versions (No fix recorded)
consul-k8s-1.6All versions (No fix recorded)
consul-k8s-fips-1.1All versions (No fix recorded)
consul-k8s-fips-1.3All versions (No fix recorded)
consul-k8s-fips-1.4All versions (No fix recorded)
consul-k8s-fips-1.5All versions (No fix recorded)
consul-k8s-fips-1.6All versions (No fix recorded)
crossplane-aws-providerAll versions (No fix recorded)
crossplane-aws-provider-fipsAll versions (No fix recorded)
dapr-daprd-1.14< 1.14.5-r27
dapr-daprd-1.15All versions (No fix recorded)
dapr-daprd-1.16All versions (No fix recorded)
dapr-daprd-fips-1.14< 1.14.5-r24
dapr-daprd-fips-1.15All versions (No fix recorded)
dapr-daprd-fips-1.16All versions (No fix recorded)
datadog-agent-7.71-fullAll versions (No fix recorded)
datadog-agent-7.77-fullAll versions (No fix recorded)
datadog-agent-7.78-fullAll versions (No fix recorded)
datadog-agent-7.79-fullAll versions (No fix recorded)
datadog-agent-fips-7.71-fullAll versions (No fix recorded)
datadog-agent-fips-7.77-fullAll versions (No fix recorded)
datadog-agent-fips-7.78-fullAll versions (No fix recorded)
datadog-agent-fips-7.79-fullAll versions (No fix recorded)
distributionAll versions (No fix recorded)
distribution-fipsAll versions (No fix recorded)
droneAll versions (No fix recorded)
drone-fipsAll versions (No fix recorded)
elastic-agent-8.19All versions (No fix recorded)
elastic-agent-9.1< 9.1.10-r17
elastic-agent-9.2< 9.2.8-r12
elastic-agent-fips-8.19All versions (No fix recorded) | < 8.19.17-r0
elastic-agent-fips-9.1< 9.1.10-r18
elastic-agent-fips-9.2< 9.2.8-r9
elastic-otel-collector-9.3< 9.3.7-r0
elastic-otel-collector-9.4All versions (No fix recorded)
elastic-otel-collector-fips-9.3< 9.3.7-r0
elastic-otel-collector-fips-9.4All versions (No fix recorded)
external-secrets-fipsAll versions (No fix recorded)
external-secrets-operator-1.1All versions (No fix recorded)
external-secrets-operator-1.2< 1.2.1-r9
external-secrets-operator-1.3< 1.3.2-r8
external-secrets-operator-2.0< 2.0.1-r9
external-secrets-operator-2.1< 2.1.0-r9
external-secrets-operator-2.2All versions (No fix recorded)
external-secrets-operator-2.3All versions (No fix recorded)
external-secrets-operator-2.4All versions (No fix recorded)
external-secrets-operator-2.5All versions (No fix recorded)
external-secrets-operator-2.6All versions (No fix recorded)
external-secrets-operator-2.7All versions (No fix recorded)
external-secrets-operator-fips-1.1All versions (No fix recorded)
external-secrets-operator-fips-1.2< 1.2.1-r5
external-secrets-operator-fips-1.3< 1.3.2-r6
external-secrets-operator-fips-2.0< 2.0.1-r8
external-secrets-operator-fips-2.1< 2.1.0-r7
external-secrets-operator-fips-2.2All versions (No fix recorded)
external-secrets-operator-fips-2.3All versions (No fix recorded)
external-secrets-operator-fips-2.4All versions (No fix recorded)
external-secrets-operator-fips-2.5All versions (No fix recorded)
external-secrets-operator-fips-2.6All versions (No fix recorded)
external-secrets-operator-fips-2.7All versions (No fix recorded)
flaggerAll versions (No fix recorded)
flagger-fipsAll versions (No fix recorded)
flyteAll versions (No fix recorded)
gatekeeper-3.20< 3.20.1-r12
gatekeeper-3.21All versions (No fix recorded)
gatekeeper-3.22All versions (No fix recorded)
gatekeeper-fips-3.20< 3.20.1-r15
gatekeeper-fips-3.21All versions (No fix recorded)
gatekeeper-fips-3.22All versions (No fix recorded)
gitlab-container-registry-18.10All versions (No fix recorded)
gitlab-container-registry-18.11All versions (No fix recorded)
gitlab-container-registry-19.0All versions (No fix recorded)
gitlab-container-registry-19.1All versions (No fix recorded)
gitlab-container-registry-fips-18.10All versions (No fix recorded)
gitlab-container-registry-fips-18.11All versions (No fix recorded)
gitlab-container-registry-fips-19.0All versions (No fix recorded)
gitlab-container-registry-fips-19.1All versions (No fix recorded)
gitlab-docker-machine-18.10All versions (No fix recorded)
gitlab-docker-machine-18.11All versions (No fix recorded)
gitlab-docker-machine-19.0All versions (No fix recorded)
gitlab-docker-machine-19.1All versions (No fix recorded)
gitlab-docker-machine-fips-18.10All versions (No fix recorded)
gitlab-docker-machine-fips-18.11All versions (No fix recorded)
gitlab-docker-machine-fips-19.0All versions (No fix recorded)
gitlab-docker-machine-fips-19.1All versions (No fix recorded)
gitnessAll versions (No fix recorded)
gitsignAll versions (No fix recorded)
go-getter-2All versions (No fix recorded)
go-getter-2-fipsAll versions (No fix recorded)
go-getter-2.1All versions (No fix recorded)
go-getter-2.2All versions (No fix recorded)
gomplate-4All versions (No fix recorded)
gomplate-5All versions (No fix recorded)
gomplate-fips-4All versions (No fix recorded)
gomplate-fips-5All versions (No fix recorded)
google-cloud-otel-ops-collectorAll versions (No fix recorded)
gostatsdAll versions (No fix recorded)
grafana-11.6All versions (No fix recorded)
grafana-12.0< 12.0.10-r4
grafana-12.1< 12.1.10.01-r11
grafana-12.2All versions (No fix recorded)
grafana-12.3All versions (No fix recorded)
grafana-12.4All versions (No fix recorded)

Show all 199

Amazon1 product

aws_s3_crypto_sdk< 2.0

2 vendors · 200 products · Showing 200 of 634

References

10 links

aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09X Refsource CONFIRMAdvisoryWEBVendor Advisory
github.com/google/security-research/security/advisories/GHSA-7f33-f4f5-xwgwX Refsource CONFIRMEVIDENCEWEBAdvisoryExploitThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2020-8912Advisory
github.com/aws/aws-sdk-go/pull/3403WEBFIX
github.com/aws/aws-sdk-go/commit/1e84382fa1c0086362b5a4b68e068d4f8518d40eWEBFIX
github.com/aws/aws-sdk-go/commit/ae9b9fd92af132cfd8d879809d8611825ba135f4WEBFIX
bugzilla.redhat.com/show_bug.cgi?id=1869801WEB
github.com/aws/aws-sdk-goPACKAGE
github.com/sophieschmieg/exploits/tree/master/aws_s3_crypto_pocWEB
pkg.go.dev/vuln/GO-2022-0646WEB