CVE-2026-3336

high Red Hat
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: March 2, 2026
Last Modified: March 2, 2026
Vendor: Red Hat

Description

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

CWE

CWE-295

Affected Products

Confidential Compute AttestationRed Hat Enterprise Linux 10Red Hat Enterprise Linux 9Red Hat OpenShift Container Platform 4Red Hat OpenShift Update ServiceRed Hat Trusted Artifact SignerRed Hat Trusted Profile Analyzer

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 aws.amazon.com 🔗 github.com