{"action":"Upgrade golang-github-aws-aws-sdk-go to 1.34.22-1 or later.","affected":[{"fixed":"1.34.22-1","introduced":"0"}],"component":"golang-github-aws-aws-sdk-go","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.34.22-1"],"id":"tcs_01M5NGK1A7M6TMKASMPHCZ5X7W","modified_at":"2026-10-15T08:01:04.757555506Z","published_at":"2022-12-27T22:15:12.390Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2022-2582","https://security-tracker.debian.org/tracker/CVE-2022-2582"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2022-2582#Debian:13/golang-github-aws-aws-sdk-go","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2022-2582"}],"summary":"The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attack"}