low

S3 Crypto SDK vulnerabilities

Published Mon, Aug 10th, 2020

Platforms

Summary

Affected Services

Remediation

Update SDK

Tracked CVEs

CVE-2020-8912, CVE-2020-8911

References

https://twitter.com/SchmiegSophie/status/1292930639772004352 https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w https://github.com/google/security-research/security/advisories/GHSA-f5pg-7wfw-84q9 https://github.com/google/security-research/security/advisories/GHSA-7f33-f4f5-xwgw https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/

Contributed by https://github.com/0xdabbad00

Entry Status

Finalized

Disclosure Date

Wed, Jul 1st, 2020

Exploitablity Period

Known ITW Exploitation

Detection Methods

Piercing Index Rating

Discovered by

Sophie Schmieg, Google

More vulnerabilities...

low

CloudTrail S3 data events leak bucket Account ID

Using CloudTrail S3 data events, it was possible to determine the AWS account ID of any existing S3 bucket by calling any S3 API, getting denied, and looking at the value in the resource key in err...

Jonathan Rault, TrustOnCloud

Mon, Jul 27th, 2020

low

XSS on EC2 web console

Display of EC2 tags had XSS

Johann Rehberger

Wed, Jul 1st, 2020

medium

GKE and EKS CAP_NET_RAW metadata service MITM root privilege escalation

An attacker with access to a hostNetwork=true container with CAP_NET_RAW capability can listen to all the traffic going through the host and inject arbitrary traffic, allowing to tamper with most u...

Etienne Champetier

Mon, Jun 15th, 2020

View all