CVE-2026-3337

medium Red Hat
CVSS v3 Base Score
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Published: March 2, 2026
Last Modified: March 2, 2026
Vendor: Red Hat

Description

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

CWE

CWE-208

Affected Products

Confidential Compute AttestationRed Hat Enterprise Linux 10Red Hat Enterprise Linux 9Red Hat OpenShift Container Platform 4Red Hat OpenShift Update ServiceRed Hat Trusted Artifact SignerRed Hat Trusted Profile Analyzer

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 aws.amazon.com 🔗 github.com