Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-8890 State: PUBLISHED Published: 2020-02-11T23:41:52 Last Updated: 2024-08-04T10:12:10.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3 - https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520 - https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
CVE ID: CVE-2020-8891 State: PUBLISHED Published: 2020-02-11T23:41:42 Last Updated: 2024-08-04T10:12:10.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3 - https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520 - https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
CVE ID: CVE-2020-8892 State: PUBLISHED Published: 2020-02-11T23:41:33 Last Updated: 2024-08-04T10:12:10.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3 - https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520 - https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
CVE ID: CVE-2020-8893 State: PUBLISHED Published: 2020-02-11T00:00:00 Last Updated: 2024-08-04T10:12:10.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121 - https://github.com/MISP/MISP/commit/3d982d92fd26584115c01f8c560a688d1096b65c - https://zigrin.com/advisories/misp-reflected-xss-in-galaxy-view/ - https://zigrin.com/advisories/misp-bruteforce-protection-not-working-in-very-specific-environments/
CVE ID: CVE-2020-8894 State: PUBLISHED Published: 2020-02-11T00:00:00 Last Updated: 2024-08-04T10:12:10.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121 - https://github.com/MISP/MISP/commit/9400b8bc8699435d84508e598aca98a31affd77c - https://zigrin.com/advisories/misp-mishandling-of-discussion-threads-acls/
CVE ID: CVE-2020-8895 State: PUBLISHED Published: 2020-04-21T17:50:11 Last Updated: 2024-08-04T10:12:11.060Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Google Products: Earth Pro Problem Types: CWE-427, DLL Hijacking Description: Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system. Additional Analyst Notes: - CVE Program Container: References: - https://support.google.com/earth/answer/40901?hl=en
CVE ID: CVE-2020-8896 State: PUBLISHED Published: 2020-05-04T13:25:04 Last Updated: 2024-08-04T10:12:11.000Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Google LLC Products: Google Earth Pro Problem Types: CWE-119 Description: A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://support.google.com/earth/answer/40901
CVE ID: CVE-2020-8897 State: PUBLISHED Published: 2020-11-16T11:55:11 Last Updated: 2024-08-04T10:12:10.984Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: Amazon Products: AWS SDK Problem Types: CWE-310 Description: A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend use
ll decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/security-research/security/advisories/GHSA-wqgp-vphw-hphf - https://aws.amazon.com/blogs/security/improved-client-side-encryption-explicit-keyids-and-key-commitment/
CVE ID: CVE-2020-8899 State: PUBLISHED Published: 2020-05-06T16:25:12.588369Z Last Updated: 2024-09-17T03:38:13.248Z Vendors: Samsung Products: Android OS Problem Types: CWE-122 Description: There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/sec
SVE-2020-16747. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 - http://packetstormsecurity.com/files/157620/Samsung-Android-Remote-Code-Execution.html - https://www.kb.cert.org/vuls/id/366027
CVE ID: CVE-2020-8902 State: PUBLISHED Published: 2021-02-23T12:00:16 Last Updated: 2024-08-04T10:12:11.061Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Google LLC Products: Rendertron Problem Types: CWE-284 Description: Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your
to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GoogleChrome/rendertron/releases/tag/3.0.0
CVE ID: CVE-2020-8903 State: PUBLISHED Published: 2020-06-22T13:45:25 Last Updated: 2024-08-04T10:12:11.047Z Vendors: Google LLC Products: guest-oslogin Problem Types: CWE-276 Description: A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to
of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29 - https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-jun
gin/pull/29 - https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 - https://cloud.google.com/support/bulletins/#gcp-2020-008 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00047.html
CVE ID: CVE-2020-8904 State: PUBLISHED Published: 2020-08-12T18:20:13.047510Z Last Updated: 2024-09-16T23:21:07.649Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H) Vendors: Google LLC Products: Asylo Problem Types: CWE-823 Description: An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later. Additional Analyst Notes: - CVE Program Container: References: - htt
recommend updating Asylo to version 0.6.0 or later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/e582f36ac49ee11a21d23ad6a30c333092e0a94e
CVE ID: CVE-2020-8905 State: PUBLISHED Published: 2020-08-12T18:20:13.466578Z Last Updated: 2024-09-17T00:06:27.121Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-120 Description: A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory
s controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/299f804acbb95a612ab7c504d25ab908aa59ae93
CVE ID: CVE-2020-8907 State: PUBLISHED Published: 2020-06-22T13:45:25 Last Updated: 2024-08-04T10:12:10.984Z Vendors: Google LLC Products: guest-oslogin Problem Types: CWE-276 Description: A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and mount the host OS. Within docker, it is possible to modify the host OS filesystem and modify /etc/groups to gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot
c/groups to gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "docker" user from the OS Login entry. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29 - https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 - https://cloud.google.com/support/bulletins/#gcp-2020-008 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00
rg/opensuse-security-announce/2020-07/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00047.html
CVE ID: CVE-2020-8908 State: PUBLISHED Published: 2020-12-10T22:10:58 Last Updated: 2024-08-04T10:12:10.998Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Google LLC Products: Guava Problem Types: CWE-378 Description: A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later an
an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/guava/issues/4011 - https://github.com/google/gua
otes: - CVE Program Container: References: - https://github.com/google/guava/issues/4011 - https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40 - https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415 - https://lists.apache.org/thread.html/r68d86f4b06c808204f62bcb254fcb5b0432528ee8d37a07ef4bc8222%40%3Ccommits.ws.apache.org%3E - https://lists.apache.org/thread.html/r215b3d50f56faeb2f9383505f3e62faa9f549bb23e8a9848b78a968e%40%3Ccommits.ws.apache.org%3E - https://lists.apache.org/thread.html/rb8c0f1b7589864396690fe42a91a71dea9412e86eec66dc85bbacaaf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r4776f62dfae4a0006658542f43034a7fc199350e35a66d4e181
%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r4776f62dfae4a0006658542f43034a7fc199350e35a66d4e18164ee6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3%40%3Ctorque-dev.db.apache.org%3E - https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba%40%3Cissues.maven.apache.org%3E - https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a%40%3Ctorque-dev.db.apache.org%3E - https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604%40%3Ctorque-dev.db.apache.org%3E - https://lists.apache.o
html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604%40%3Ctorque-dev.db.apache.org%3E - https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rfc27e2727a20a574f39273e0432aa97486a332f9b3068f6ac1346594%40%3Cdev.myfaces.apache.org%3E - https://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95%40%3Cgithub.arrow.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/r2fe45d96eea8434b91592ca08109118f6308d60f6d0e21d52438cfb4%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread
r2fe45d96eea8434b91592ca08109118f6308d60f6d0e21d52438cfb4%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/r07ed3e4417ad043a27bee7bb33322e9bfc7d7e6d1719b8e3dfd95c14%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/r6874dfe26eefc41b7c9a5e4a0487846fc4accf8c78ff948b24a1104a%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/r161b87f8037bbaff400194a63cd2016c9a69f5949f06dcc79beeab54%40%3Cdev.drill.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.apache.org/thread.html/ra7ab308481ee729f998691e8e3e02e93b1dedfc98f6b1cd3d86923b3%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rf0
98691e8e3e02e93b1dedfc98f6b1cd3d86923b3%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rf00b688ffa620c990597f829ff85fdbba8bf73ee7bfb34783e1f0d4e%40%3Cyarn-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r58a8775205ab1839dba43054b09a9ab3b25b423a4170b2413c4067ac%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/re120f6b3d2f8222121080342c5801fdafca2f5188ceeb3b49c8a1d27%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r49549a8322f62cd3acfa4490d25bfba0be04f3f9ff4d14fe36199d27%40%3Cyarn-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rcafc3a637d82bdc9a24036b2ddcad1e519dd0e6f848fcc
0%3Cyarn-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rcafc3a637d82bdc9a24036b2ddcad1e519dd0e6f848fcc3d606fd78f%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/r007add131977f4f576c232b25e024249a3d16f66aad14a4b52819d21%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/reebbd63c25bc1a946caa419cec2be78079f8449d1af48e52d47c9e85%40%3Cissues.geode.apache.org%3E - https://lists.apache.org/thread.html/r79e47ed555bdb1180e528420a7a2bb898541367a29a3bc6bbf0baf2c%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/rd2704306ec729ccac726e50339b8a8f079515cc29ccb77713b16e7c5%40%3Cissues.hive.apache.org%3E - https://lists.apa
thread.html/rd2704306ec729ccac726e50339b8a8f079515cc29ccb77713b16e7c5%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r5d61b98ceb7bba939a651de5900dbd67be3817db6bfcc41c6e04e199%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r7b0e81d8367264d6cad98766a469d64d11248eb654417809bfdacf09%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rb2364f4cf4d274eab5a7ecfaf64bf575cedf8b0173551997c749d322%40%3Cgitbox.hive.apache.org%3E - https://lists.apache.org/thread.html/r294be9d31c0312d2c0837087204b5d4bf49d0552890e6eec716fa6a6%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rf9f0fa84b8ae1a285f0210bafe
90e6eec716fa6a6%40%3Cyarn-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rf9f0fa84b8ae1a285f0210bafec6de2a9eba083007d04640b82aa625%40%3Cissues.geode.apache.org%3E - https://lists.apache.org/thread.html/r5b3d93dfdfb7708e796e8762ab40edbde8ff8add48aba53e5ea26f44%40%3Cissues.geode.apache.org%3E - https://lists.apache.org/thread.html/r3dd8881de891598d622227e9840dd7c2ef1d08abbb49e9690c7ae1bc%40%3Cissues.geode.apache.org%3E - https://lists.apache.org/thread.html/rc607bc52f3507b8b9c28c6a747c3122f51ac24afe80af2a670785b97%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.apache.org/thread.html/rd7e12d56d49d73e2b8549694974b07561
www.oracle.com/security-alerts/cpuoct2021.html - https://lists.apache.org/thread.html/rd7e12d56d49d73e2b8549694974b07561b79b05455f7f781954231bf%40%3Cdev.pig.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220210-0003/
CVE ID: CVE-2020-8910 State: PUBLISHED Published: 2020-03-26T11:38:26 Last Updated: 2024-08-04T10:12:10.953Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Google Products: Closure-Library Problem Types: CWE-625, Bad URL parsing Description: A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9 - https://g
ner: References: - https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9 - https://github.com/google/closure-library/releases/tag/v20200315
CVE ID: CVE-2020-8911 State: PUBLISHED Published: 2020-08-11T19:20:14 Last Updated: 2024-08-04T10:12:11.063Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Google LLC Products: AWS S3 Crypto SDK for GoLang Problem Types: CWE-327 Description: A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*l
or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files. Additional Analyst Notes: - CVE Program Container: References: - https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09 - https://github.com/google/security-research/security/advisories/GHSA-f5pg-7wfw-84q9
CVE ID: CVE-2020-8912 State: PUBLISHED Published: 2020-08-11T19:20:14 Last Updated: 2024-08-04T10:12:10.969Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Google LLC Products: AWS S3 Crypto SDK for GoLang Problem Types: CWE-327 Description: A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the au
tion with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files. Additional Analyst Notes: - CVE Program Container: References: - https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09 - https://github.com/google/security-research/security/advisories/GHSA-7f33-f4f5-xwgw
CVE ID: CVE-2020-8913 State: PUBLISHED Published: 2020-08-12T07:10:12 Last Updated: 2024-08-04T10:12:10.972Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Google LLC Products: Android Play Core Problem Types: CWE-281 Description: A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommen