PT-2026-22702 · Amazon Web Services · Aws-Lc

Joshua Rogers · Publicado 2026-03-02 · Atualizado 2026-03-11 · CVE-2026-3336

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS-LC versions prior to 1.69.0

Description A flaw exists in the PKCS7 verify() function within AWS-LC that allows an unauthenticated user to circumvent certificate chain verification when handling PKCS7 objects containing multiple signers, excluding the final signer. This improper certificate validation could potentially allow malicious actors to compromise the integrity of secure communications.

Recommendations Upgrade AWS-LC to version 1.69.0 or later.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-3336

GHSA-CFWJ-9WP5-WQVP

GHSA-VW5V-4F2Q-W9XF

RUSTSEC-2026-0046

Produtos afetados

Aws-Lc

Referências · 23

• https://github.com/aws/aws-lc/releases/tag/v1.69.0 · Correção
• https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp · Aviso do Fabricante
• https://github.com/aws/aws-lc-rs · Nota
• https://github.com/aws/aws-lc-rs/security/advisories/GHSA-vw5v-4f2q-w9xf · Nota
• https://t.me/CVEtracker/46171 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-3336 · Aviso do Fabricante
• https://twitter.com/Sohan_Intel/status/2030536163858186303 · Publicação no Twitter
• https://t.me/cveNotify/155127 · Publicação no Telegram
• https://twitter.com/Huntio/status/2029935081708569050 · Publicação no Twitter
• https://t.me/msrcreports/3311 · Publicação no Telegram
• https://t.me/cveNotify/154813 · Publicação no Telegram
• https://aws.amazon.com/security/security-bulletins/2026-005-AWS · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2026-0046 · Aviso do Fabricante
• https://twitter.com/threatcluster/status/2029489681025347947 · Publicação no Twitter
• https://rustsec.org/advisories/RUSTSEC-2026-0046.html · Nota