CVE-2026-3337

Опубликовано: 02 мар. 2026

Источник: nvd

CVSS3: 5.9

EPSS Низкий

Описание

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.

The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Ссылки

https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
Vendor Advisory
https://github.com/aws/aws-lc/releases/tag/v1.69.0
Release Notes
https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:amazon:aws-lc-fips-sys:*:*:*:*:*:rust:*:*

Версия от 0.13.0 (включая) до 0.13.12 (исключая)

cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*

Версия от 0.14.0 (включая) до 0.38.0 (исключая)

cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*

Версия от 1.21.0 (включая) до 1.69.0 (исключая)

cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:fips:*:*:*

Версия от 3.0.0 (включая) до 3.2.0 (исключая)

EPSS

Процентиль: 7%

0.00027

Низкий

5.9 Medium

CVSS3

Дефекты

CWE-208

Связанные уязвимости

CVE-2026-3337

CVSS3: 6.5

redhat

24 дня назад

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.