CVE-2020-8911

A flaw was found in the AWS S3 Crypto SDK that allows users to encrypt files stored in S3 buckets with AES-CBC, without computing a MAC on the data. This allows for a padding oracle, enabling attackers with both write access to the target S3 bucket and the ability to observe the result of valid decryption attempts to potentially recover original plaintext. This is not an issue if files in S3 buckets are not encrypted with CBC mode, which is disabled in V2 of the AWS S3 Crypto SDK.