aws / aws/aws-encryption-sdk-python

Error when calling API to decrypt Cognito MFA code: '65 is not a valid SerializationVersion'

Ouverte
#695 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
Python
Étoiles
255
Forks
92
Merge moyen
2 j 17 h
PR mergées (30 j)
2

Description

### Security issue notifications

N/A

### Problem:

I'm following the steps here: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sms-sender.html to have Cognito call my lambda which needs to decrypt the MFA code and use a custom API to email it ( since Cognito doesn't support email MFA :/ )

Getting error: 65 is not a valid SerializationVersion
I never set any version other than LambdaVersion=V1_0 as outlined in the doc above so I have no idea where that is from.

Stack trace:
```
Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 87, in _verified_version_from_id
return SerializationVersion(version_id)
File "/var/lang/lib/python3.9/enum.py", line 384, in __call__
return cls.__new__(cls, value)
File "/var/lang/lib/python3.9/enum.py", line 702, in __new__
raise ve_exc
ValueError: 65 is not a valid SerializationVersion

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/__init__.py", line 186, in decrypt
plaintext = decryptor.read()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 250, in read
self._prep_message()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 782, in _prep_message
self._header, self.header_auth = self._read_header()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 797, in _read_header
header, raw_header = deserialize_header(self.source_stream, self.config.max_encrypted_data_keys)
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 336, in deserialize_header
version = _verified_version_from_id(version_id)
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 89, in _verified_version_from_id
raise NotSupportedError("Unsupported version
{}
".format(version_id), error)
aws_encryption_sdk.exceptions.NotSupportedError: ('Unsupported version 65', ValueError('65 is not a valid SerializationVersion'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/streaming_client.py", line 218, in __exit__
self.close()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 985, in close
raise SerializationError("Footer not read")
aws_encryption_sdk.exceptions.SerializationError: Footer not read
```

### Solution:

Looking for one.

### Out of scope:

N/A

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Commencez par aws_encryption_sdk/internal/formatting/deserialize.py et le flux de l’expéditeur SMS personnalisé dans la documentation Cognito liée. Reproduisez l’appel de déchiffrement avec l’entrée signalée et examinez les erreurs de version de sérialisation et de footer ; c’est terminé lorsque le texte chiffré MFA est déchiffré sans les exceptions de version non prise en charge ou de footer.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
aws, python
Domaine
cryptography, security
Type d'issue
Bug
Difficulté
4/5
Temps estimé
3-5 jours
Activité
À l'abandon
Clarté
À clarifier
Accessibilité débutants
25/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.