AWS-LC PKCS7 Signature Validation Bypass Vulnerability

A vulnerability in AWS-LC's PKCS7_verify() function allows an unauthenticated user to bypass signature validation. This issue arises when processing PKCS7 objects that contain Authenticated Attributes. The vulnerability is present in AWS-LC versions 1.41.0 prior to 1.69.0, as well as in aws-lc-sys versions 0.24.0 prior to 0.38.0.

Impact

Exploitation of this vulnerability allows for unauthorized bypassing of signature validation in PKCS7 objects, which could lead to the acceptance of fraudulent signatures or unauthorized modifications being recognized as valid.

Remediation

Users of AWS-LC should upgrade to version 1.69.0. For those using aws-lc-sys, the upgrade to version 0.38.0 is recommended.