Most recent entries from all

Withdrawn: CLEANSTART-2026-CN84623 — Within HostnameError

Withdrawn by the publisher.

Affected: CleanStart: opentofu-fips

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details.

EUVD-2026-38736

fkie_cve-2020-8912

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

GHSA-7f33-f4f5-xwgw — In-band key negotiation issue in AWS S3 Crypto SDK for golang

Affected: Go: github.com/aws/aws-sdk-go

### Summary

The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures (without revealing the plaintext) and that when encrypting the GCM option was chosen as content cipher.

### Risk/Severity

The vulnerability pose insider risks/privilege escalation risks, circumventing KMS controls for stored data.

### Impact

This advisory describes the plaintext revealing vulnerabilities in the golang AWS S3 Crypto SDK, with a similar issue in the non "strict" versions of C++ and Java S3 Crypto SDKs being present as well.

V1 prior to 1.34.0 of the S3 crypto SDK does not authenticate the algorithm parameters for the data encryption key.

An attacker with write access to the bucket can use this in order to change the encryption algorithm of an object in the bucket, which can lead to problems depending on the supported algorithms. For example, a switch from AES-GCM to AES-CTR in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation.

By default, the only available algorithms in the SDK are AES-GCM and AES-CBC. Switching the algorithm from AES-GCM to AES-CBC can be used as way to reconstruct the plaintext through an oracle endpoint revealing decryption failures, by b…

gsd-2020-8912

openSUSE-SU-2024:14599-1 — govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

RHSA-2021:3851 — Red Hat Security Advisory: Red Hat 3scale API Management 2.11.0 Release - Container Images

aws/aws-sdk-go: CBC padding oracle issue in AWS S3 Crypto SDK for golang aws-sdk-go: In-band key negotiation issue in AWS S3 Crypto SDK for golang RHOAM: XSS in 3scale at various places 3scale: missing validation of access token nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name

WID-SEC-W-2024-0794 — Dell ECS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.