TI-2026-02881 Aliases CVE-2026-3338

PKCS7_verify Signature Validation Bypass in AWS-LC

MEDIUM 45CWE-347Published 2026-03-02 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-347.

Summary

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00776 56th percentileScored 2026-11-07

Fix Partial AWS-LC (AWS): 1.69.0Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AWS	AWS-LC	1.41.0 to before 1.69.0	1.69.0	Patch available	CNA

AWS-LC VendorAWS Affected 1.41.0 to before 1.69.0 Fixed in 1.69.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:amazon:aws-lc-sys::::::rust::*	0.24.0 to before 0.38.0	Vulnerable	AWS
cpe:2.3:a:amazon:aws_libcrypto::::::::	1.41.0 to before 1.69.0	Vulnerable	AWS

cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:* Versions 0.24.0 to before 0.38.0 Vulnerable ·AWS
cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:* Versions 1.41.0 to before 1.69.0 Vulnerable ·AWS

Remediation

Fix · CNA AWS-LC (AWS) Fixed in 1.69.0

Red Hat 1 advisory

RHSA-2026:5459 Released 2026-03-23 · Red Hat rating Important
RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-03-02
AWS-LC — aws.amazon.com/security/security-bulletins/2026-005-AWS
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-02879 PKCS7_verify Certificate Chain Validation Bypass in AWS-LCPriority MEDIUM 45
- TI-2026-02880 Timing Side-Channel in AES-CCM Tag Verification in AWS-LCPriority LOW 38
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Confidential Compute Attestation	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 10	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat OpenShift Container Platform 4	Affected	No fix planned: Will not fix
Red Hat Trusted Profile Analyzer	Affected	No fix planned: Will not fix
Red Hat Trusted Artifact Signer 1.3	Fixed	RHSA-2026:5459

Not affected: 3 products

Confidential Compute Attestation
Red Hat Enterprise Linux 10
Red Hat OpenShift Update Service

Timeline

2026-10-02 Threatist record created from CVE-2026-3338
2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/aws/aws-lc/releases/tag/v1.69.0

Advisory 2

TI-2026-02879 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC CVSS 4.0HIGH 8.7
TI-2026-02880 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences