Description (CNA)
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AWS / AWS-LC | affected 1.41.0 before 1.69.0 |
CWE
CWE-347
References
- https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
- https://github.com/aws/aws-lc/releases/tag/v1.69.0
- https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in AWS-LC. An unauthenticated user can bypass signature verification when processing PKCS7 objects with Authenticated Attributes due to improper signature validation in the PKCS7_verify() function. This vulnerability allows an attacker to potentially compromise the integrity of signed data.