PT-2026-26369 · Amazon Web Services · Aws-Lc-Fips-Sys+2

CVE-2026-4428 · Publicado 2026-03-19 · Atualizado 2026-04-01

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Crítica

Vetor base

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AWS-LC versions prior to 1.71.0 aws-lc-sys versions 0.15.0 through 0.39.0 aws-lc-fips-sys versions 0.13.0 through 0.13.13

Description A logic error in CRL distribution point validation in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not require action. The issue affects applications using aws-lc-sys and aws-lc-fips-sys.

Recommendations Upgrade AWS-LC to version 1.71.0 or later. Upgrade aws-lc-sys to the most recent release. Upgrade aws-lc-fips-sys to the most recent release. As a workaround, disable CRL checking (X509 V FLAG CRL CHECK). As a workaround, use complete (non-partitioned) CRLs without IDP extensions.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

CWE-299

Identificadores relacionados

CLEANSTART-2026-EV91316

CLEANSTART-2026-HH87643

CLEANSTART-2026-JM60128

CLEANSTART-2026-KW90815

CLEANSTART-2026-LK63891

CVE-2026-4428

GHSA-9F94-5G5W-GF6R

RUSTSEC-2026-0042

RUSTSEC-2026-0048

Produtos afetados

Aws-Lc

Aws-Lc-Fips-Sys

Aws-Lc-Sys

Referências · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4428.json · Exploit
• https://github.com/aws/aws-lc/releases/tag/v1.71.0 · Correção
• https://github.com/aws/aws-lc-rs · Nota
• https://github.com/aws/aws-lc-rs/security/advisories/GHSA-9f94-5g5w-gf6r · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LK63891.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JM60128.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EV91316.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KW90815.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HH87643.json · Nota
• https://osv.dev/vulnerability/CLEANSTART-2026-JM60128 · Aviso do Fabricante
• https://osv.dev/vulnerability/ghsa-394x-vwmw-crm3 · Nota
• https://osv.dev/vulnerability/ghsa-hfpc-8r3f-gw53 · Nota
• https://rustsec.org/advisories/RUSTSEC-2026-0042.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4428 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-vw5v-4f2q-w9xf · Nota