| Package | Affected versions | Patched versions |
|---|---|---|
| aws-lc-sys | ≥ 0.24.0, < 0.38.0 | 0.38.0 |
| aws libcrypto | ≥ 1.41.0, < 1.69.0 | 1.69.0 |
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free