{"id":"CVE-2026-3338","details":"Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.\n\n\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","aliases":["GHSA-hfpc-8r3f-gw53","GHSA-jchq-39cv-q4wj","RUSTSEC-2026-0047"],"modified":"2026-03-20T17:25:59.250880Z","published":"2026-03-02T22:16:32.350Z","references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-005-AWS/"},{"type":"ADVISORY","url":"https://github.com/aws/aws-lc/releases/tag/v1.69.0"},{"type":"ADVISORY","url":"https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aws/aws-lc","events":[{"introduced":"dd5948b5a55f5dc5f0db9bbfa0e21c35d9e820e2"},{"fixed":"37d86461a95782fd5d8b77873f9e1cb134ea2f95"}],"database_specific":{"versions":[{"introduced":"1.41.0"},{"fixed":"1.69.0"}]}}],"versions":["AWS-LC-FIPS-NETOS-v1.29.1","v1.41.0","v1.41.1","v1.42.0","v1.43.0","v1.44.0","v1.45.0","v1.46.0","v1.46.1","v1.47.0","v1.48.0","v1.48.1","v1.48.2","v1.48.3","v1.48.4","v1.48.5","v1.49.0","v1.49.1","v1.50.0","v1.50.1","v1.51.0","v1.51.1","v1.51.2","v1.52.0","v1.52.1","v1.53.0","v1.53.1","v1.54.0","v1.55.0","v1.56.0","v1.57.0","v1.57.1","v1.58.0","v1.58.1","v1.59.0","v1.60.0","v1.61.0","v1.61.1","v1.61.2","v1.61.3","v1.61.4","v1.62.0","v1.62.1","v1.63.0","v1.64.0","v1.65.0","v1.65.1","v1.66.0","v1.66.1","v1.66.2","v1.67.0","v1.68.0"],"database_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["280062061547051961335040704369984099310","59664889025735122861240116516903930146","186491128754061308478941699848016839286","44181818329089001225657707026569626534","282671460555005303787248492658194669900","44166289732973386761265031133498341556","69817426707179551398336772625900832321","239604874112229803444893855053965253409"]},"id":"CVE-2026-3338-855e3c0b","target":{"file":"crypto/pkcs7/pkcs7.c"},"deprecated":false,"source":"https://github.com/aws/aws-lc/commit/37d86461a95782fd5d8b77873f9e1cb134ea2f95","signature_type":"Line","signature_version":"v1"},{"digest":{"length":2013,"function_hash":"158135805622728784577576606639969624490"},"id":"CVE-2026-3338-dc456f72","target":{"function":"pkcs7_signature_verify","file":"crypto/pkcs7/pkcs7.c"},"deprecated":false,"source":"https://github.com/aws/aws-lc/commit/37d86461a95782fd5d8b77873f9e1cb134ea2f95","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3338.json","unresolved_ranges":[{"events":[{"introduced":"0.24.0"},{"fixed":"0.38.0"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}