Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.
Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Aws-lc-sys | Amazon | 0.24.0 (including) | 0.38.0 (excluding) |
| Aws_libcrypto | Amazon | 1.41.0 (including) | 1.69.0 (excluding) |