CVE-2026-3336

Katalog CVE

CVSS 7.5 · High EPSS 0,40%

Kerentanan Improper Certificate Validation pada amazon aws-lc-sys, amazon aws libcrypto. Skor CVSS 3.1 7.5 (High) menurut CNA.

Deskripsi (NVD)

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ advisory vendor
• https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp advisory vendor
• https://github.com/aws/aws-lc/releases/tag/v1.69.0 release notes
• https://access.redhat.com/errata/RHSA-2026:5459
• https://access.redhat.com/security/cve/CVE-2026-3336
• https://bugzilla.redhat.com/show_bug.cgi?id=2444026
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3336.json