A critical vulnerability in AWS-LC allows unauthenticated attackers to bypass certificate chain verification, potentially leading to the acceptance of forged or malicious signatures.

The flaw exists in the PKCS7_verify() function within the AWS-LC library, which fails to correctly validate certificate chains when processing PKCS7 objects containing multiple signers. An unauthenticated attacker can leverage this to bypass security checks for all but the final signer in the chain.

The ability to bypass cryptographic signature verification poses a significant risk to the integrity of secure communications and signed data pipelines. Successful exploitation could allow attackers to spoof trusted signers, leading to the unauthorized acceptance of malicious code or data. With a CVSS score of 7.5, this high-severity vulnerability warrants immediate attention to prevent potential man-in-the-middle or supply-chain compromise.

Immediate Action: Upgrade the AWS-LC library to version 1.69.0 or higher. For users of the Rust crate, ensure the dependency is updated to aws-lc-sys version 0.38.0.

Proactive Monitoring: Review application logs for unusual authentication patterns or failed signature verification errors that may indicate an attacker is testing the library for weaknesses.

Compensating Controls: While no direct virtual patch exists, ensure that downstream applications consuming these certificates implement additional secondary validation checks on cryptographic signatures where possible.

Public Exploit Available: No (exploit_available: unknown)

Given the central role of AWS-LC in securing various services and applications, the risk associated with this certificate validation bypass is significant. Organizations should prioritize the identification of all software components incorporating this library and apply the provided updates immediately to restore the integrity of their certificate verification processes.