Security Finding: Update package aws-sdk-go@v1.53.11

    • None
    • pkg:golang/github.com/aws/aws-sdk-go@v1.53.11
    • Tools and Replicator
    • master

      Priority from VULN: Low
      This is a copy of the linked VULN ticket issue. You only need to update this ticket and the VULN ticket will be synced accordingly.


      Vulnerability Details

      The following vulnerabilities were found in the third party component pkg:golang/github.com/aws/aws-sdk-go@v1.53.11 used in the repo: https://github.com/mongodb/mongo-tools:

      CVE Severity CVSS Fixed Version(s)
      CVE-2020-8911 Medium 6 None
      CVE-2020-8912 Low 3 None

      How do I fix this?
      Currently, there is no fix/remediation available for the above vulnerabilitie(s) as per our vulnerability scanner. To take action on this ticket, it is recommended to do the following:

      1. Refer to the reference links below to see if there actually is a fix available that was not captured by the scanner or to see if a fix is actively being worked on.
      2. Consider submitting a PR to the third-party/open source respository to resolve the vulnerability, if possible.
      3. Ensure that the library is still being maintained. If the library is no longer maintained, it is highly recommended to utilize a new library.

      If you have gone through the above list and it's still not clear how to action this ticket, you should investigate if your application is affected by the vulnerabilities referenced in this ticket. If it is not affected, you can mark this ticket as a false positive.

      If you need additional assistance, please reach out in the #secure-sdlc-program channel.

      References:

      Tool Description: A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

      🔥 Please see go/vuln-flow for detailed guidance.

              Assignee:
              Shyam Subramaniyam
              Reporter:
              Mothra Jira Bot
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: