Medium severity4.3NVD Advisory· Published Dec 27, 2022· Updated Jun 17, 2026
CVE-2022-2582
CVE-2022-2582
Description
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/aws/aws-sdk-goGo | < 1.34.0 | 1.34.0 |
Affected products
13- osv-coords11 versionspkg:apk/chainguard/k3d-toolspkg:apk/wolfi/k3dpkg:apk/chainguard/kubevirt-cdi-uploadserver-1.59pkg:apk/chainguard/kubevirt-cdi-uploadserver-fips-1.59pkg:golang/github.com/aws/aws-sdk-gopkg:apk/wolfi/k3d-proxypkg:apk/chainguard/k3dpkg:apk/chainguard/kubevirt-cdi-uploadserver-fips-1.5pkg:apk/chainguard/k3d-proxypkg:apk/chainguard/kubevirt-cdi-uploadserver-1.5pkg:apk/wolfi/k3d-tools
< 5.6.0-r11+ 10 more
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 1.34.0
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 0
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 0
- (no CPE)range: < 5.6.0-r11
- github.com/aws/aws-sdk-go/github.com/aws/aws-sdk-go/service/s3/s3cryptov5Range: 0
- cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:go:*:*Range: <1.34.0
Patches
Vulnerability mechanics
References
5- github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1nvdPatchThird Party AdvisoryWEB
- pkg.go.dev/vuln/GO-2022-0391nvdExploitPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-6jvc-q2x7-pchvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-2582ghsaADVISORY
- github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7wghsaWEB
News mentions
0No linked articles in our index yet.