CVE-2026-3338

Опубликовано: 02 мар. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Ссылки

https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
Vendor Advisory
https://github.com/aws/aws-lc/releases/tag/v1.69.0
Release Notes
https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*

Версия от 0.24.0 (включая) до 0.38.0 (исключая)

cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*

Версия от 1.41.0 (включая) до 1.69.0 (исключая)

EPSS

Процентиль: 1%

0.0001

Низкий

7.5 High

CVSS3

Дефекты

CWE-347

Связанные уязвимости

CVE-2026-3338

CVSS3: 7.5

redhat

24 дня назад

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

CVE-2026-3338

msrc

22 дня назад

PKCS7_verify Signature Validation Bypass in AWS-LC

EPSS

Процентиль: 1%

0.0001

Низкий

7.5 High

CVSS3

Дефекты

CWE-347