REDHAT-BUG-2444026: High severity AWS AWS-LC vulnerability
Improper certificate validation in PKCS7verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.
Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS-LCto a version that resolves this vulnerability.Fixed in 1.69.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2444026?
The severity of REDHAT-BUG-2444026 is high, rated at 7.
What does REDHAT-BUG-2444026 describe?
REDHAT-BUG-2444026 describes improper certificate validation in PKCS7_verify() in AWS-LC, allowing unauthenticated users to bypass certificate chain verification.
Who is affected by REDHAT-BUG-2444026?
Customers using AWS services are not required to take action, as the issue primarily affects applications using AWS-LC.
How does REDHAT-BUG-2444026 impact applications?
REDHAT-BUG-2444026 allows potential bypass of certificate verification in applications using AWS-LC when processing PKCS7 objects with multiple signers.
Is there a fix for REDHAT-BUG-2444026?
Users of AWS services do not need to take action, but applications using AWS-LC should update to the latest version to ensure proper certificate validation.