Junglewise Threat Intelligence

CVE-2026-3338: AWS AWS-LC signature verification bypass in PKCS7_verify

CVE-2026-3338 · Severity: high · CVSS 7.5 · Published 2026-03-02

Technologies: Red Hat Trusted Artifact Signer, AWS-LC, Red Hat Enterprise Linux, Aws-Lc-Sys, aws-lc-sys (crates.io). Vendors: Red Hat, Amazon, AWS, crates.io.

Executive brief

AWS-LC is a cryptographic library used by applications to secure data and verify digital signatures. A flaw in this library allows an attacker to bypass signature verification when processing certain types of signed objects. This could allow unauthorized or malicious data to be accepted as authentic, potentially leading to the execution of untrusted code or the acceptance of forged documents.

Technical details

A vulnerability exists in AWS-LC's PKCS7_verify() function due to improper validation of cryptographic signatures when processing PKCS7 objects that include Authenticated Attributes. An unauthenticated remote attacker can exploit this by providing a specially crafted PKCS7 object, causing the library to incorrectly report a successful signature verification. This bypasses the integrity protections intended by the PKCS7 standard. The issue is rooted in how the library handles the transition or comparison of attributes during the verification process. The vulnerability is addressed in AWS-LC version 1.69.0 and aws-lc-sys version 0.38.0.

Affected products

  • AWS AWS-LC >= 1.41.0, < 1.69.0
  • AWS aws-lc-sys >= 0.24.0, < 0.38.0
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Red Hat Enterprise Linux 9, 10

Timeline

  • 2026-03-02: advisory: Initial advisory published by AWS and GitHub Security Advisory issued.
  • 2026-03-02: patched: AWS-LC version 1.69.0 released.
  • 2026-03-23: advisory: Red Hat published security advisory RHSA-2026:5459.

References

Related threats