{"id":"CVE-2026-3338","state":"PUBLISHED","title":"PKCS7_verify Signature Validation Bypass in AWS-LC","description":"Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.\n\n\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","publishedAt":"2026-03-02T21:22:41.954Z","updatedAt":"2026-08-21T12:12:53.379Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","source":"AMZN"},"assigner":"AMZN","products":["AWS AWS-LC"],"affected":[{"vendor":"AWS","product":"AWS-LC","defaultStatus":"unaffected","versions":[{"version":"1.41.0","status":"affected","lessThan":"1.69.0","versionType":"custom"}]}],"references":["https://aws.amazon.com/security/security-bulletins/2026-005-AWS/","https://github.com/aws/aws-lc/releases/tag/v1.69.0","https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj","https://access.redhat.com/security/cve/CVE-2026-3338","https://bugzilla.redhat.com/show_bug.cgi?id=2444025","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json","https://access.redhat.com/errata/RHSA-2026:5459"],"weaknesses":["CWE-347"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/3xxx/CVE-2026-3338.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-3338","state":"PUBLISHED","datePublished":"2026-03-02T21:22:41.954Z","dateUpdated":"2026-08-21T12:12:53.379Z","assignerShortName":"AMZN","assignerOrgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","dateReserved":"2026-02-27T15:16:29.281Z"},"containers":{"cna":{"title":"PKCS7_verify Signature Validation Bypass in AWS-LC","descriptions":[{"lang":"en","value":"Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.\n\n\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0."}],"affected":[{"vendor":"AWS","product":"AWS-LC","defaultStatus":"unaffected","versions":[{"version":"1.41.0","status":"affected","lessThan":"1.69.0","versionType":"custom"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-005-AWS/","tags":["vendor-advisory"]},{"url":"https://github.com/aws/aws-lc/releases/tag/v1.69.0","tags":["patch"]},{"url":"https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"CWE-347 (Improper Verification of Cryptographic Signature)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"AMZN","orgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","dateUpdated":"2026-03-02T22:13:54.867Z"},"impacts":[{"capecId":"CAPEC-475","descriptions":[{"lang":"en","value":"CAPEC-475 (Signature Spoofing by Improper Validation)"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-03T14:39:41.025325Z","id":"CVE-2026-3338","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-03T14:39:48.768Z"}},{"title":"aws-lc: AWS-LC: Signature bypass due to improper validation in PKCS7_verify()","descriptions":[{"lang":"en","value":"A flaw was found in AWS-LC. An unauthenticated user can bypass signature verification when processing PKCS7 objects with Authenticated Attributes due to improper signature validation in the PKCS7_verify() function. This vulnerability allows an attacker to potentially compromise the integrity of signed data."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer 1.3","packageName":"rhtas/tuffer-rhel9","defaultStatus":"affected","versions":[{"version":"1773307309","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer 1.3","packageName":"rhtas/tuftool-rhel9","defaultStatus":"affected","versions":[{"version":"1773307309","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.3::el9"]},{"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-monitor-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"]},{"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-operator-bundle","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"]},{"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"]},{"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-podvm-payload-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"]},{"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-rhel9-operator","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"clevis-pin-trustee","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"trustee","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"virt-firmware-rs","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"clevis-pin-trustee","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"kata-containers","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Update Service","packageName":"openshift-update-service/openshift-update-service-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_update_service:5"]},{"vendor":"Red Hat","product":"Red Hat Trusted Profile Analyzer","packageName":"rhtpa/rhtpa-trustification-service-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:2"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-3338","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444025","name":"RHBZ#2444025","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5459","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-21T12:12:53.379Z"},"datePublic":"2026-03-02T21:22:41.954Z","solutions":[{"lang":"en","value":"RHSA-2026:5459: Red Hat Trusted Artifact Signer 1.3"}],"timeline":[{"lang":"en","time":"2026-03-02T22:01:12.080Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-02T21:22:41.954Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}