CVE-2020-8911

CVE-2020-8911 is a medium-severity padding oracle vulnerability in the AWS S3 Crypto SDK for GoLang versions prior to V2. It allows an attacker with write access to an S3 bucket to reconstruct encrypted plaintext by exploiting AES-CBC without MAC and PKCS5 padding errors, requiring an average of 128 * plaintext length queries. The attack vector is local with high attack complexity, potentially leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion.