aws lc

About this tag
The AWS-LC tag on WindowsForum.com covers discussions about Amazon's open-source cryptographic library, AWS-LC, which is a fork of OpenSSL. Recent threads focus on critical security patches in version 1.69.0 that address PKCS#7/CMS verification bypass vulnerabilities (CVE-2026-3338 and CVE-2026-3336) and an AES-CCM timing side-channel issue (CVE-2026-3337). These flaws could allow attackers to bypass signature validation or certificate chain checks. The tag includes updates on supply-chain patch urgency, advisory details, and rebuild recommendations for consumers using affected versions. Topics are relevant to developers, security engineers, and IT professionals managing cryptographic dependencies in Windows or cross-platform environments.

  1. AWS-LC Patch Fixes PKCS#7 Verification Bypass CVE-2026-3338 (v1.69.0)

    AWS‑LC, Amazon’s open‑source cryptographic library, received an emergency set of patches in early March 2026 after researchers disclosed a pair of PKCS#7/CMS verification flaws and an AES‑CCM timing issue. One of those defects, tracked as CVE‑2026‑3338, is a signature validation bypass in the...

  2. AWS LC Patch Fixes PKCS#7 Chain Validation in v1.69.0

    AWS’ open-source cryptographic library AWS‑LC received a pair of serious PKCS#7 validation fixes in early March 2026 after researchers reported that the library’s PKCS7_verify() routine could incorrectly bypass certificate chain validation for certain multi‑signer PKCS#7 objects, allowing...