Executive brief
Amazon::Credentials is a Perl module used to manage and provide AWS credentials. In versions up to 1.2.0, the library uses a weak and predictable method to generate the encryption keys used to protect sensitive credentials in memory. This could allow an attacker with access to a system's memory or data dumps to easily guess the keys and expose the underlying AWS secrets, potentially leading to unauthorized access to cloud resources.
Technical details
Amazon::Credentials (versions <= 1.2.0) utilizes the built-in Perl 'rand' function to generate 64-bit encryption keys used for obfuscating AWS secrets within object data dumps. Because 'rand' is a non-cryptographic PRNG, the resulting keys are predictable. An attacker who obtains a data dump of the object or has local access to the execution environment could potentially brute-force or predict the key to decrypt sensitive AWS access keys and session tokens. The vulnerability was addressed in version 1.3.0 by removing the flawed encryption/obfuscation feature in favor of a more secure implementation.
Affected products
- Perl CPAN Amazon::Credentials through 1.2.0
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-05: patched: Version 1.3.0 released