aws / aws/aws-encryption-sdk-python

Error when calling API to decrypt Cognito MFA code: '65 is not a valid SerializationVersion'

オープン
#695 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Python
スター
255
フォーク
92
平均マージ
2日 17時間
マージ済み PR(30日)
2

説明

### Security issue notifications

N/A

### Problem:

I'm following the steps here: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sms-sender.html to have Cognito call my lambda which needs to decrypt the MFA code and use a custom API to email it ( since Cognito doesn't support email MFA :/ )

Getting error: 65 is not a valid SerializationVersion
I never set any version other than LambdaVersion=V1_0 as outlined in the doc above so I have no idea where that is from.

Stack trace:
```
Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 87, in _verified_version_from_id
return SerializationVersion(version_id)
File "/var/lang/lib/python3.9/enum.py", line 384, in __call__
return cls.__new__(cls, value)
File "/var/lang/lib/python3.9/enum.py", line 702, in __new__
raise ve_exc
ValueError: 65 is not a valid SerializationVersion

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/__init__.py", line 186, in decrypt
plaintext = decryptor.read()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 250, in read
self._prep_message()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 782, in _prep_message
self._header, self.header_auth = self._read_header()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 797, in _read_header
header, raw_header = deserialize_header(self.source_stream, self.config.max_encrypted_data_keys)
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 336, in deserialize_header
version = _verified_version_from_id(version_id)
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 89, in _verified_version_from_id
raise NotSupportedError("Unsupported version
{}
".format(version_id), error)
aws_encryption_sdk.exceptions.NotSupportedError: ('Unsupported version 65', ValueError('65 is not a valid SerializationVersion'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/streaming_client.py", line 218, in __exit__
self.close()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 985, in close
raise SerializationError("Footer not read")
aws_encryption_sdk.exceptions.SerializationError: Footer not read
```

### Solution:

Looking for one.

### Out of scope:

N/A

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

aws_encryption_sdk/internal/formatting/deserialize.py と、リンク先の Cognito ドキュメントにあるカスタム SMS 送信者フローから始めます。報告された入力を使って復号呼び出しを再現し、シリアライズバージョンと footer のエラーを調べます。MFA の暗号文が unsupported-version または footer の例外なしに復号できれば完了です。

索引モデルが issue の本文から書いたものです。

評価

技術スタック
aws, python
領域
cryptography, security
issue の種類
バグ
難易度
4/5
見積もり時間
3〜5日
活発さ
停滞
明瞭さ
説明が足りない
初心者へのやさしさ
25/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。