UnsafeUsageOfClientSideEncryptionVersion.qhelp

<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>


  <overview>
    <p>Azure Storage .NET, Java, and Python SDKs support encryption on the client with a customer-managed key that is maintained in Azure Key Vault or another key store.</p>
    <p>Current release versions of the Azure Storage SDKs use cipher block chaining (CBC mode) for client-side encryption (referred to as <code>v1</code>).</p>

  </overview>
  <recommendation>

    <p>Consider switching to <code>v2</code> client-side encryption.</p>

  </recommendation>
  <example>

    <sample src="UnsafeUsageOfClientSideEncryptionVersion.py" />

  </example>
  <references>
    <li>
      <a href="http://aka.ms/azstorageclientencryptionblog">Azure Storage Client Encryption Blog.</a>
    </li>
    <li>
      <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30187">CVE-2022-30187</a>
    </li>

  </references>
</qhelp>