AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field

MEDIUM 4.3CVE-2022-2582 · GHSA-6jvc-q2x7-pchv · GHSA-76wf-9vgp-pj7w · Published 27/12/2022 · updated 17/06/2026

In short

CVE-2022-2582 is a MEDIUM (CVSS 4.3) vulnerability affecting github.com/aws/aws-sdk-go, aws software development kit (amazon).
Chance of exploitation in the next 30 days (EPSS): 0.51%, higher than 43.8% of all vulnerabilities.
Fix: update to 1.34.0 or later.

Package	Affected versions	Patched versions
github.com/aws/aws-sdk-go Go	`< 1.34.0`	`1.34.0`
aws software development kit amazon	`< 1.34.0`	`1.34.0`

Description

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.

NVD description

References

google/security-research security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-2582 · ADVISORY
aws/aws-sdk-go commit 35fa6dd · WEB
aws/aws-sdk-go · PACKAGE
pkg.go.dev/vuln/GO-2022-0391 · WEB

More vulnerabilities in github.com/aws/aws-sdk-go

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/aws/aws-sdk-go

< 1.34.0

1.34.0

aws software development kit

amazon

< 1.34.0

1.34.0

Description

NVD description

More vulnerabilities in github.com/aws/aws-sdk-go

See all →