Medium severity · published Dec 27, 2022
CVE-2022-2582
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Aws Software Development Kit · Amazon
before 1.34.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2582
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2582
Patch
https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1
Exploit
https://pkg.go.dev/vuln/GO-2022-0391
More from Aws Software Development Kit
9.8
CVE-2022-4725
A vulnerability was found in AWS SDK 2.59.0
7.2
CVE-2018-19981
Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service
5.9
CVE-2026-19642
Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp
5.3
CVE-2026-19643
Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms
3.3
CVE-2023-51651
AWS SDK for PHP is the Amazon Web Services software development kit for PHP