PT-2026-22703 · Amazon Web Services · Aws-Lc

Joshua Rogers · Publicado 2026-03-02 · Atualizado 2026-03-11 · CVE-2026-3337

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS-LC versions prior to 1.69.0

Description An observable timing discrepancy in AES-CCM decryption within AWS-LC could allow an unauthenticated user to potentially determine authentication tag validity through timing analysis. The impacted implementations utilize the EVP CIPHER API, specifically EVP aes 128 ccm, EVP aes 192 ccm, and EVP aes 256 ccm.

Recommendations Upgrade to AWS-LC version 1.69.0.

Correção

Enumeração de Fraquezas

CWE-208

Identificadores relacionados

CVE-2026-3337

GHSA-65P9-R9H6-22VJ

GHSA-FRMV-5GCM-JWXH

RUSTSEC-2026-0043

RUSTSEC-2026-0045

Produtos afetados

Aws-Lc

Referências · 25

• https://github.com/aws/aws-lc/releases/tag/v1.69.0 · Correção
• https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh · Aviso do Fabricante
• https://github.com/aws/aws-lc-rs · Nota
• https://github.com/aws/aws-lc-rs/security/advisories/GHSA-65p9-r9h6-22vj · Nota
• https://osv.dev/vulnerability/CVE-2026-3337 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2028590102218166655 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028588959186534445 · Publicação no Twitter
• https://t.me/cveNotify/155128 · Publicação no Telegram
• https://twitter.com/Huntio/status/2029935081708569050 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2028642309244424328 · Publicação no Twitter
• https://osv.dev/vulnerability/RUSTSEC-2026-0043 · Aviso do Fabricante
• https://t.me/cveNotify/154039 · Publicação no Telegram
• https://aws.amazon.com/security/security-bulletins/2026-005-AWS · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3337 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-65p9-r9h6-22vj · Aviso do Fabricante