Aws Lc Sys

aws-lc-sys

Vendor: Amazon • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-3338 2Amazon Aws 3Aws Lc Sys Aws LibcryptoAws Libcrypto Mar 11, 2026 Mar 2, 2026 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not n...Show more Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.Show less
CVE-2026-3337 2Amazon Aws 4Aws Lc Fips Sys Aws Lc SysAws Libcrypto+1 more Mar 11, 2026 Mar 2, 2026 8.2 HIGH· v4 5.9 MEDIUM· v3 N/A· v2 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP...Show more Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.Show less
CVE-2026-3336 2Amazon Aws 3Aws Lc Sys Aws LibcryptoAws Libcrypto Mar 11, 2026 Mar 2, 2026 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers...Show more Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.Show less