Skip to content
Fencer Intel
low 2.5

CVE-2020-8912 json

In-band key negotiation issue in AWS S3 Crypto SDK for GoLang

published 6y ago modified last mo. also GHSA-7f33-f4f5-xwgw , GO-2022-0635 , EUVD-2022-0887

cvss
2.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

Patch / fix

  • go github.com/aws/aws-sdk-go 1.34.0
  • amazon aws_s3_crypto_sdk 2.0
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20241213T205935-1.1

opensuse advisories openSUSE-SU-2024:14599-1

Is CVE-2020-8912 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8912 updated cvss 2.5

aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto SDK for golang

  • Red Hat A-MQ Interconnect 1 amq-ic-1/amq-cert-manager-container Red Hat OpenShift Serverless cli, knative-serving knative-serving, knative-eventing knative-eventing Red Hat Fuse 7 fuse-7/dv-operator-container
    affected: no fix available “Fix deferred”
  • Red Hat Integration Service Registry rhint-serv-1/integration-service-registry-operator-container
    affected: no fix available
  • Red Hat 3Scale AMP 2.11 3scale-amp2/system-rhel7 1.15.0-8, 3scale-amp2/zync-rhel8 3scale2.11.0, 3scale-amp2/backend-rhel8 3scale2.11.0, 3scale-amp2/toolbox-rhel8 3scale2.11.0, 3scale-amp2/memcached-rhel7 3scale2.11.0, 3scale-amp2/3scale-rhel7-operator 3scale2.11.0, +4 more
    fixed: vendor fix RHSA-2021:3851
  • Red Hat OpenShift Service Mesh 1 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-galley, servicemesh-citadel, servicemesh-grafana, +7 more Red Hat Advanced Cluster Management for Kubernetes 2 awk-sdk-go Red Hat Ceph Storage 2 grafana Red Hat Ceph Storage 3 grafana Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Cluster Application Migration rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8
    +5 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-kserve-llmisvc-controller-rhel9, rhoai/odh-trustyai-service-operator-rhel9 Red Hat OpenShift Container Platform 3.11 prometheus, atomic-openshift, openshift3/grafana, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, +11 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift4/ose-cli, openshift-hyperkube, openshift4/ose-grafana, +24 more Red Hat Openshift Container Storage 4 mcg, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat Storage 3 grafana, noobaa-operator-container, multi-cloud-object-gateway-cli, rhgs3/rhgs-gluster-block-prov-rhel7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/google/security-research/security/advisories/GHSA-7f33-f4f5-xwgw referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/aws/aws-sdk-go
<1.34.0
all versions
1.34.0

Affected products

  • Google LLC AWS S3 Crypto SDK for GoLang

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.