CVE-2026-3338

HIGH

AWS-LC < 1.69.0 - Improper Verification of Cryptographic Signature in PKCS7_verify()

Title source: llm

Description

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

References (7)

Core 7

Core References

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:5459

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-3338

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2444025

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json

Various Sources vendor-advisory

https://aws.amazon.com/security/security-bulletins/2026-005-AWS/

Release Notes patch

https://github.com/aws/aws-lc/releases/tag/v1.69.0

Vendor Advisory third-party-advisory

https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj

Scores

CVSS v3 7.5

EPSS 0.0078

EPSS Percentile 52.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-347

Status published

Products (3)

amazon/aws-lc-sys 0.24.0 - 0.38.0

amazon/aws_libcrypto 1.41.0 - 1.69.0

AWS/AWS-LC 1.41.0 - 1.69.0

Published Mar 02, 2026

Tracked Since Mar 03, 2026