Description
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.
Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS | AWS-LC | 1.41.0 – < 1.69.0 | 1.69.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-efs-utils | 3.0.0-4.amzn2023 | ALAS2023-2026-1564 |
| Amazon Linux 2023 | mount-s3 | 1.22.2-1.amzn2023 | ALAS2023-2026-1510 |
| Amazon Linux 2 | amazon-efs-utils | 3.0.0-4.amzn2 | ALAS2-2026-3245 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | aws-lc-sys | >= 0.24.0, < 0.38.0 | 0.38.0 | GHSA-vw5v-4f2q-w9xf |
Advisories 3
- ALAS2-2026-3245 Important: amazon-efs-utils security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- ALAS2023-2026-1564 Important: amazon-efs-utils security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- ALAS2023-2026-1510 Important: mount-s3 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 1, 2026