Description
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS S3 Crypto SDK for GoLang | stable – ≤ V1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241213T205935-1.1 | openSUSE-SU-2024:14599-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | external-secrets-operator-1.1 | No fix yet | — |
| Wolfi rolling | k3d +2 | 5.6.0-r11 | — |
| Wolfi rolling | kots | 1.130.6-r0 | — |
| Wolfi rolling | loki-3.6 +1 | 3.6.12-r0 | — |
| Wolfi rolling | loki-3.7 +1 | 3.7.3-r0 | — |
| Wolfi rolling | mattermost-11.1 | 11.1.3-r8 | — |
| Wolfi rolling | opentelemetry-collector | 0.155.0-r0 | — |
| Wolfi rolling | ruby3.3-fluent-plugin-grafana-loki-3.7 | 3.7.7-r4 | — |
| Wolfi rolling | zot | 2.1.18-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/aws/aws-sdk-go | < 1.34.0 | 1.34.0 | GHSA-7f33-f4f5-xwgw |
| Go | github.com/aws/aws-sdk-go | all versions | — | GO-2022-0635 |
Advisories 2
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2024:14599-1 govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026