Summary
The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Certain inputs to the Base64 decoder in the SDK's core library, on some platforms, might cause the decoder to read outside the bounds of its decode table.
Impact
Certain inputs to the Base64 decoder, on some platforms, might cause the decoder to read outside the bounds of its decode table, which might crash the process performing the decode.
The decoder is reachable from the generated C++ service clients, which use it for a variety of features.
Impacted versions: <= 1.11.861
Patches
This issue has been addressed in AWS SDK for C++ version 1.11.862. The SDK's Base64 implementation now delegates to the implementation in the AWS Common Runtime (aws-crt-cpp). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Customers who vendor or statically link the SDK should confirm that their build consumes the updated aws-crt-cpp submodule, not only the updated SDK sources.
Workarounds
There is no configuration or runtime option that avoids this issue. Upgrading is required.
References
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
We would like to thank Lucas Carvalho Cordeiro (@lucasccordeiro) and Rafael Sa Menezes (@rafaelsamenezes) of the University of Manchester for collaborating on this issue through the coordinated vulnerability disclosure process.
lucasccordeiro Finder
rafaelsamenezes Finder
Summary
The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Certain inputs to the Base64 decoder in the SDK's core library, on some platforms, might cause the decoder to read outside the bounds of its decode table.
Impact
Certain inputs to the Base64 decoder, on some platforms, might cause the decoder to read outside the bounds of its decode table, which might crash the process performing the decode.
The decoder is reachable from the generated C++ service clients, which use it for a variety of features.
Impacted versions: <= 1.11.861
Patches
This issue has been addressed in AWS SDK for C++ version 1.11.862. The SDK's Base64 implementation now delegates to the implementation in the AWS Common Runtime (
aws-crt-cpp). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.Customers who vendor or statically link the SDK should confirm that their build consumes the updated
aws-crt-cppsubmodule, not only the updated SDK sources.Workarounds
There is no configuration or runtime option that avoids this issue. Upgrading is required.
References
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
We would like to thank Lucas Carvalho Cordeiro (@lucasccordeiro) and Rafael Sa Menezes (@rafaelsamenezes) of the University of Manchester for collaborating on this issue through the coordinated vulnerability disclosure process.