7.5
High
CVE-2026-3336 Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain…
Description
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Trusted Artifact Signer 1.3 1773307309 | earliest → < 1773307309 | 1773307309 |
| Confidential Compute Attestation | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Trusted Profile Analyzer | Versions not published | |
| Red Hat OpenShift Update Service | Versions not published | |
| AWS-LC 1.41 | 1.41.0 → < 1.69.0 | 1.69.0 |
References
- aws.amazon.com aws.amazon.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Trusted Artifact Signer 1.3
The 55 CVEs of Red Hat Trusted Artifact Signer 1.3 →
CVE-2026-44486
Axios is a promise based HTTP client for the browser and Node.js
7.5
High
CVE-2026-44487
Axios is a promise based HTTP client for the browser and Node.js
8.2
High
CVE-2026-44488
Axios is a promise based HTTP client for the browser and Node.js
7.5
High
CVE-2026-44496
Axios is a promise based HTTP client for the browser and Node.js
7.5
High