Skip to content
OpenAdvisories
Medium ALAS2023-2026-1905 1 CVE

Moderate: aws-nitro-tpm-tools security update (Amazon Linux 2023)

Published Jul 6, 2026 · Updated Jul 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 aws-nitro-tpm-tools 0:1.1.2-1.amzn2023

Vulnerabilities 1

  • High 7.4
    CVE-2026-4428

    CRL Distribution Point Scope Check Logic Error in AWS-LC

    A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should up…

    AWS AWS-LC AWS-LC-FIPS aws-lc-sys crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-4428.html