5.9
Moyenne
CVE-2026-3337 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine…
Description
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| AWS-LC 1.21 | 1.21.0 → < 1.69.0 | 1.69.0 |
| AWS-LC-FIPS 3.0 | 3.0.0 → < 3.2.0 | 3.2.0 |
Références
- aws.amazon.com aws.amazon.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de AWS-LC
Les 4 CVE de AWS-LC →
CVE-2026-4428
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly…
7.4
Élevée
CVE-2026-3338
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature…
7.5
Élevée
CVE-2026-3336
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain…
7.5
Élevée