CVE-2026-3337

MEDIUM

5.9

Descripcion

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Detalles CVE

Puntuacion CVSS v3.15.9

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado3/2/2026

Ultima modificacion3/11/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

amazon:aws-lc-fips-sysamazon:aws-lc-sysamazon:aws_libcrypto

Debilidades (CWE)

CWE-208

Referencias

https://aws.amazon.com/security/security-bulletins/2026-005-AWS/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/aws/aws-lc/releases/tag/v1.69.0(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.