Skip to content
OpenAdvisories
Medium ALAS2023-2026-1655 1 CVE

Moderate: mount-s3 security update (Amazon Linux 2023)

Published May 11, 2026 · Updated May 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 mount-s3 0:1.22.3-1.amzn2023
Amazon Linux · 2023 mount-s3-debuginfo 0:1.22.3-1.amzn2023
Amazon Linux · 2023 mount-s3-debugsource 0:1.22.3-1.amzn2023

Vulnerabilities 1

  • High 7.4
    CVE-2026-4428

    CRL Distribution Point Scope Check Logic Error in AWS-LC

    A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should up…

    AWS AWS-LC AWS-LC-FIPS aws-lc-sys crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-4428.html