CVE-2026-3338

high Red Hat
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: March 2, 2026
Last Modified: March 2, 2026
Vendor: Red Hat

Description

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

CWE

CWE-347

Affected Products

Confidential Compute AttestationRed Hat Enterprise Linux 10Red Hat Enterprise Linux 9Red Hat OpenShift Container Platform 4Red Hat OpenShift Update ServiceRed Hat Trusted Artifact SignerRed Hat Trusted Profile Analyzer

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 aws.amazon.com 🔗 github.com