x/vulndb: suggestion regarding GO-2022-0646

[jcmackie]

Report ID

GO-2022-0646

Suggestion/Comment

Hello team,

I wanted to let you know that we've recently become aware that aws-sdk-go is still vulnerable to CVE-2020-8911.

CVE-2020-8911 is listed as an alias of GO-2022-0646, which I think might not be true as they are different vulnerabilities, I believe.

You can see where some other sites classify even the latest version of this library as still vulnerable:
https://nvd.nist.gov/vuln/detail/cve-2020-8911

Up to (excluding) 2.0

https://www.cve.org/CVERecord?id=CVE-2020-8911

affected from stable through V1

We have even confirmed with AWS themselves that the V1 clients which are still part of the SDK are still vulnerable to this issue.
They have decided to keep them in the library and accessible for compatibility reasons.

If you can update the status for your VULN DB for this library, that will make it easier for teams and projects to understand the risk, and hopefully encourage them to upgrade to V2.

Regards,
James Mackie

[gopherbot]

Change https://go.dev/cl/635736 mentions this issue: data/reports: add GO-2022-0635, review GO-2022-0646

[tatianab]

Hi, thanks for bringing this up. I have split the reports and removed the fixed version.

[jcmackie]

Thanks so much for the quick response @tatianab.

I was just curious about one thing. In the new report that's been created, the CVE ID is:

cves:
    - CVE-2020-8912

But I think it should probably be CVE-2020-8911, unless I am mistaken about that?
CVE-2020-8912 is a similar but different attack on AES-GCM used in the V1 clients.

Interesting to note is that AWS say in their blog about this:

As AES-GCM is now supported and performant in all modern runtimes and languages, we’re removing AES-CBC as an option for encrypting new objects.

But as far as I can tell, it's still trivially easy to use AES-CBC to encrypt new objects using the V1 clients.

Kind regards,
James

[tatianab]

Hi @jcmackie, apologies for the delay. There are now two reports: https://pkg.go.dev/vuln/GO-2022-0635 covering CVE-2020-8912 and https://pkg.go.dev/vuln/GO-2022-0646 covering CVE-2020-8911. Is this correct, or is there still something that should be changed?