A logic error in the AWS-LC cryptographic library allows revoked certificates to bypass validation checks, potentially compromising the integrity of secure communications.

The vulnerability is an improper check for certificate revocation (CWE-299) that occurs during CRL distribution point validation. An unauthenticated attacker can leverage this flaw to ensure that revoked certificates are accepted as valid by the affected library.

This vulnerability poses a significant risk to the authenticity and confidentiality of encrypted traffic. By bypassing revocation checks, an attacker could potentially utilize compromised or revoked certificates to perform man-in-the-middle attacks or impersonate trusted entities. With a CVSS score of 7.4, this high-severity flaw requires prompt attention to maintain the trust boundary of internal and external network services.

Immediate Action: Update AWS-LC to version 1.71.0 or AWS-LC-FIPS to version 3.3.0. For environments utilizing Rust, ensure the dependent crates are updated to aws-lc-sys 0.39.0 or aws-lc-fips-sys 0.13.13.

Proactive Monitoring: Review application logs for unusual TLS handshake patterns or certificate validation errors that may indicate an attempt to utilize revoked credentials.

Compensating Controls: Ensure that network-level traffic inspection is active and that certificate pinning is implemented where feasible to reduce reliance on standard revocation checks in high-risk environments.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for certificate validation bypass, organizations should prioritize the update of any services or applications bundling the AWS-LC library. Failure to address this flaw leaves systems vulnerable to the acceptance of revoked identities, which undermines the core security posture of TLS-dependent communications. Apply the provided fixes immediately to restore robust certificate revocation enforcement.