CVE-2026-3337

MEDIUM

5.9

Descricao

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Detalhes CVE

Pontuacao CVSS v3.15.9

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado3/2/2026

Ultima modificacao3/11/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

amazon:aws-lc-fips-sysamazon:aws-lc-sysamazon:aws_libcrypto

Fraquezas (CWE)

CWE-208

Referencias

https://aws.amazon.com/security/security-bulletins/2026-005-AWS/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/aws/aws-lc/releases/tag/v1.69.0(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.