Moderate severityNVD Advisory· Published Dec 27, 2022· Updated Apr 11, 2025
Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
CVE-2022-2582
Description
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/aws/aws-sdk-goGo | < 1.34.0 | 1.34.0 |
Affected products
12- osv-coords11 versionspkg:apk/chainguard/k3dpkg:apk/chainguard/k3d-proxypkg:apk/chainguard/k3d-toolspkg:apk/chainguard/kubevirt-cdi-uploadserver-1.5pkg:apk/chainguard/kubevirt-cdi-uploadserver-1.59pkg:apk/chainguard/kubevirt-cdi-uploadserver-fips-1.5pkg:apk/chainguard/kubevirt-cdi-uploadserver-fips-1.59pkg:apk/wolfi/k3dpkg:apk/wolfi/k3d-proxypkg:apk/wolfi/k3d-toolspkg:golang/github.com/aws/aws-sdk-go
< 5.6.0-r11+ 10 more
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 1.34.0
- github.com/aws/aws-sdk-go/github.com/aws/aws-sdk-go/service/s3/s3cryptov5Range: 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-6jvc-q2x7-pchvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-2582ghsaADVISORY
- github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1ghsaWEB
- github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7wghsaWEB
- pkg.go.dev/vuln/GO-2022-0391ghsaWEB
News mentions
0No linked articles in our index yet.