A critical vulnerability in the AWS-LC cryptographic library allows unauthenticated attackers to bypass signature verification, potentially compromising the integrity of processed data.

This vulnerability is caused by improper verification of cryptographic signatures (CWE-347) within the PKCS7_verify() function. An unauthenticated attacker can exploit this flaw to bypass signature checks when processing PKCS7 objects containing authenticated attributes.

The ability to bypass signature verification can lead to the acceptance of malicious or tampered data as authentic, effectively breaking the chain of trust for any application relying on AWS-LC for cryptographic operations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data integrity and system security. Organizations may face unauthorized data modification or the execution of malicious code if the bypassed signature was intended to validate software updates or configuration files.

Immediate Action: Developers and system administrators must upgrade their applications to AWS-LC version 1.69.0 or the corresponding crates.io/aws-lc-sys version 0.38.0.

Proactive Monitoring: Review application logs for unexpected PKCS7 processing errors or anomalies in signature verification routines that may indicate attempts to exploit the library.

Compensating Controls: While no direct virtual patch exists for this library-level flaw, ensure that applications using the affected library are isolated within secure network segments to minimize exposure to untrusted input.

Public Exploit Available: Unknown.

The vulnerability in AWS-LC is a serious cryptographic flaw that requires immediate attention from any organization integrating this library into their software stack. Because the vulnerability is automatable and allows for unauthenticated exploitation, the risk of widespread scanning and exploitation is elevated. Developers should prioritize upgrading their dependencies to the fixed versions immediately to restore the integrity of their cryptographic verification processes.