GHSA-hfpc-8r3f-gw53 CVE-2026-3338 GHSA-jchq-39cv-q4wj RUSTSEC-2026-0047
AWS-LC has PKCS7_verify Signature Validation Bypass
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.78%
- Chance of exploitation in the next 30 days. Higher than 55.82% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-347 Improper Verification of Cryptographic Signature
- Fix
0.38.0- Upgrade aws-lc-sys to this version or later
Description
Summary
AWS-LC is an open-source, general-purpose cryptographic library.
Impact
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.
Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.
Impacted versions:
aws-lc-sys versions: >= 0.24.0, < 0.38.0
Patches
The patch is included in v0.38.0
Workarounds
There is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.
Resources
If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| aws-lc-sys | >= 0.24.0, < 0.38.0 |
0.38.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
aws-lc-sys crates.io → 0.38.0
- cargo
cargo update -p aws-lc-sys --precise 0.38.0
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
References
Advisories
Packages
Other links
- github.com/aws/aws-lc-rs/security/advisories/GHSA-hfpc-8r3f-gw53
- github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj
- aws.amazon.com/security/security-bulletins/2026-005-AWS
- rustsec.org/advisories/RUSTSEC-2026-0047.html
- github.com/aws/aws-lc/releases/tag/v1.69.0
- access.redhat.com/errata/RHSA-2026:5459
- access.redhat.com/security/cve/CVE-2026-3338
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9f94-5g5w-gf6r CRL Distribution Point Scope Check Logic Error in AWS-LC | Critical | Also affects aws-lc-sys |
| GHSA-394x-vwmw-crm3 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN | High | Also affects aws-lc-sys |
| GHSA-vw5v-4f2q-w9xf AWS-LC has PKCS7_verify Certificate Chain Validation Bypass | High | Also affects aws-lc-sys |
| GHSA-65p9-r9h6-22vj AWS-LC has Timing Side-Channel in AES-CCM Tag Verification | Medium | Also affects aws-lc-sys |
| EEF-CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability | Not rated yet | Same weakness, CWE-347 |
| GHSA-pxh4-856f-4h89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery | High | Same weakness, CWE-347 |
| GHSA-j7h2-66j4-ghjf A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request | Low | Same weakness, CWE-347 |
| GHSA-w2cx-738m-mc7w PyJWT accepts public JWK containers as HMAC secrets | High | Same weakness, CWE-347 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor