CVE-2026-3336

Опубликовано: 02 мар. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Ссылки

https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
Vendor Advisory
https://github.com/aws/aws-lc/releases/tag/v1.69.0
Release Notes
https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*

Версия от 0.24.0 (включая) до 0.38.0 (исключая)

cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*

Версия от 1.41.0 (включая) до 1.69.0 (исключая)

EPSS

Процентиль: 1%

0.0001

Низкий

7.5 High

CVSS3

Дефекты

CWE-295

Связанные уязвимости

CVE-2026-3336

CVSS3: 7.5

redhat

24 дня назад

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

CVE-2026-3336

msrc

21 день назад

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

EPSS

Процентиль: 1%

0.0001

Низкий

7.5 High

CVSS3

Дефекты

CWE-295