aws / aws/aws-encryption-sdk-python
Error when calling API to decrypt Cognito MFA code: '65 is not a valid SerializationVersion'
- 主要语言
- Python
- 星标
- 255
- 派生
- 92
- 平均合并
- 2 天 17 小时
- 30 天内合并 PR
- 2
描述
### Security issue notifications
N/A
### Problem:
I'm following the steps here: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sms-sender.html to have Cognito call my lambda which needs to decrypt the MFA code and use a custom API to email it ( since Cognito doesn't support email MFA :/ )
Getting error: 65 is not a valid SerializationVersion
I never set any version other than LambdaVersion=V1_0 as outlined in the doc above so I have no idea where that is from.
Stack trace:
```
Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 87, in _verified_version_from_id
return SerializationVersion(version_id)
File "/var/lang/lib/python3.9/enum.py", line 384, in __call__
return cls.__new__(cls, value)
File "/var/lang/lib/python3.9/enum.py", line 702, in __new__
raise ve_exc
ValueError: 65 is not a valid SerializationVersion
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/__init__.py", line 186, in decrypt
plaintext = decryptor.read()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 250, in read
self._prep_message()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 782, in _prep_message
self._header, self.header_auth = self._read_header()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 797, in _read_header
header, raw_header = deserialize_header(self.source_stream, self.config.max_encrypted_data_keys)
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 336, in deserialize_header
version = _verified_version_from_id(version_id)
File "/var/task/aws_encryption_sdk/internal/formatting/deserialize.py", line 89, in _verified_version_from_id
raise NotSupportedError("Unsupported version
{}
".format(version_id), error)
aws_encryption_sdk.exceptions.NotSupportedError: ('Unsupported version 65', ValueError('65 is not a valid SerializationVersion'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/var/task/aws_encryption_sdk/streaming_client.py", line 218, in __exit__
self.close()
File "/var/task/aws_encryption_sdk/streaming_client.py", line 985, in close
raise SerializationError("Footer not read")
aws_encryption_sdk.exceptions.SerializationError: Footer not read
```
### Solution:
Looking for one.
### Out of scope:
N/A
[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )
贡献指南
调研方向
从 aws_encryption_sdk/internal/formatting/deserialize.py 和链接的 Cognito 文档中的自定义 SMS sender 流程开始。使用报告的输入重现解密调用,并检查 serialization version 和 footer 错误;当 MFA ciphertext 能够在不触发 unsupported-version 或 footer 异常的情况下完成解密时,即表示完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- aws, python
- 领域
- cryptography, security
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 需要澄清
- 新手友好度
- 25/100