PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Summary

AWS-LC is an open-source, general-purpose cryptographic library.

Impact

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to the most recent release of AWS-LC.

Impacted versions

From v1.41.0 through v1.68.0.

Patches

The patch is included in v1.69.0.

Workarounds

There is no workaround. Applications using AWS-LC should upgrade to the most recent release of AWS-LC.

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Acknowledgement

We would like to thank Joshua Rogers (https://joshua.hu/) of AISLE Research Team (https://aisle.com) for collaborating on this issue through the coordinated vulnerability disclosure process.