CVE-2022-2582

The CVE-2022-2582 issue concerns the AWS S3 Crypto SDK (Go) sending an unencrypted hash of the plaintext as a metadata field alongside ciphertext. This could enable brute‑force of the plaintext if readable. AWS has since blocks this field in newer SDKs; older versions still send it. Mitigation: u...

CVE-2022-2582 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...

CVE-2022-2582 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...

CVE-2022-2582

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...

S3Crets_Scanner - Hunting For Secrets Uploaded To Public S3 Buckets

S3cret Scanner tool designed to provide a complementary layer for the Amazon S3 Security Best Practices by proactively hunting secrets in public S3 buckets. Can be executed as scheduled task or On-Demand Automation workflow The automation will perform the following actions: 1. List the public...

Top American Online Ed Platform Leaks 22TB of Data

By Waqas In total, 117 million files were exposed due to two misconfigured Amazon Web Services S3 buckets. This is a post from HackRead.com Read the original post: Top American Online Ed Platform Leaks 22TB of Data...

Virtuozzo Hybrid Server 7.5 Update 4 (7.5.4-465)

Virtuozzo Hybrid Server 7.5 Update 4 introduces new features and provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1160.80.1.vz7.191.4. Vulnerability id: PSBM-142718 Node IP was not set when changing 'vnclisten' in '/etc/libvirt/qemu.conf.' Vulnerability id:...

Brave Software: S3 Bucket Takeover : brave-apt

An unclaimed S3 bucket was found on the domain brave.com, which was being used in the installation of brave-browser in Linux distros. An attacker could have taken over the S3 bucket and used it to spread malware or create a fake login page to spoof users. The vulnerability was reported to the...

s3.amazonaws.com Cross Site Scripting vulnerability OBB-3068374

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Khan Academy: S3 bucket takeover [learn2.khanacademy.org]

The subdomain learn2.khanacademy.org was pointed to Amazon S3, but no bucket with that name was registered learn2.khanacademy.org. This meant that anyone could sign up for Amazon S3, claim the bucket as their own and then serve content. Steps to reproduce Check the following url:...

GHSA-RC39-G977-687W Use of unclaimed s3 bucket in tests and examples

Impact People who use some older NLP examples that reference the old S3 bucket. Patches The problem has been patched. Upgrade to snapshots for now. A release will be published later to address this due to the vulnerability mostly being examples and 1 class in the actual code base. Workarounds...

Use of unclaimed s3 bucket in tests and examples

Impact People who use some older NLP examples that reference the old S3 bucket. Patches The problem has been patched. Upgrade to snapshots for now. A release will be published later to address this due to the vulnerability mostly being examples and 1 class in the actual code base. Workarounds...

CVE-2022-36022

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use...

s3.kz Cross Site Scripting vulnerability OBB-3046630

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-36022

CVE-2022-36022 affects Deeplearning4J up to version 1.0.0-M2.1, where certain tests and examples (packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests) may reference unclaimed S3 buckets. Root cause: tests and NLP example code referencing old, unowned S3 storage. Report...

CVE-2022-36022 Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use...

Eclipse Deeplearning4J 安全特征问题漏洞

Eclipse Deeplearning4J Eclipse DL4J is a set of projects from the Eclipse Foundation designed to support all the needs of JVM-based deep learning applications. A security vulnerability exists in Eclipse Deeplearning4J 1.0.0-M2.1 and earlier versions, which stems from the possibility of using some...

Virtuozzo Hybrid Infrastructure 5.3 (5.3.0-130)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover Kubernetes as a Service, storage performance, security, monitoring and alerts, and the user interface. Additionally, this release delivers stability improvements and addresses issues found in previous...

AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

S3 Explorer Plugin stores AWSSECRETACCESSKEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration. While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the...

GHSA-MF4P-WJRM-CMJP AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

S3 Explorer Plugin stores AWSSECRETACCESSKEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration. While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the...