https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:53:14 +0000 https://vulnerability.circl.lu/vuln/ghsa-vw5v-4f2q-w9xf <p><strong>Affected:</strong> crates.io: aws-lc-sys</p> <p>### Summary AWS-LC is an open-source, general-purpose cryptographic library.</p> <p>### Impact Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.</p> <p>Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.</p> <p>#### Impacted versions: aws-lc-sys versions: &gt;= 0.24.0, &lt; 0.38.0</p> <p>### Patches The patch is included in v0.38.0</p> <p>### Workarounds There is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.</p> <p>### Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> <p>### Acknowledgement AWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process.</p> <p><strong>Affected:</strong> crates.io: aws-lc-sys</p> <p>### Summary AWS-LC is an open-source, general-purpose cryptographic library.</p> <p>### Impact Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.</p> <p>Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.</p> <p>#### Impacted versions: aws-lc-sys versions: &gt;= 0.24.0, &lt; 0.38.0</p> <p>### Patches The patch is included in v0.38.0</p> <p>### Workarounds There is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.</p> <p>### Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> <p>### Acknowledgement AWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process.</p> https://vulnerability.circl.lu/vuln/ghsa-vw5v-4f2q-w9xf