Out-of-bounds read in the Base64 decoder in the AWS SDK for C++

## Summary The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Certain inputs to the Base64 decoder in the SDK's core library, on some platforms, might cause the decoder to read outside the bounds of its decode table. ## Impact Certain inputs to the Base64 decoder, on some platforms, might cause the decoder to read outside the bounds of its decode table, which might crash the process performing the decode. The decoder is reachable from the generated C++ service clients, which use it for a variety of features. Impacted versions: <= 1.11.861 ## Patches This issue has been addressed in AWS SDK for C++ version 1.11.862. The SDK's Base64 implementation now delegates to the implementation in the AWS Common Runtime (`aws-crt-cpp`). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Customers who vendor or statically link the SDK should confirm that their build consumes the updated `aws-crt-cpp` submodule, not only the updated SDK sources. ## Workarounds There is no configuration or runtime option that avoids this issue. Upgrading is required. ## References If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. ## Acknowledgement We would like to thank Lucas Carvalho Cordeiro (@lucasccordeiro) and Rafael Sa Menezes (@rafaelsamenezes) of the University of Manchester for collaborating on this issue through the coordinated vulnerability disclosure process.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-125

• github.com/aws/aws-sdk-cpp/security/advisories/GHSA-mxm9-xpf9-x66x
• github.com/aws/aws-sdk-cpp