https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 06:52:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274114 EUVD-2026-274114 https://cve.radiocsirt.org/vuln/euvd-2026-274114 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3337 <p>Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.</p> <p>The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.</p> <p>Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.</p> <p>Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.</p> <p>The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.</p> <p>Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-3337 https://cve.radiocsirt.org/vuln/rustsec-2026-0043 <p><strong>Affected:</strong> crates.io: aws-lc-fips-sys</p> <p>Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.</p> <p>The impacted implementations are through the EVP CIPHER API: `EVP_aes_128_ccm`, `EVP_aes_192_ccm`, and `EVP_aes_256_ccm`.</p> <p>Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.</p> <p>## Workarounds</p> <p>In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations `EVP_aead_aes_128_ccm_bluetooth`, `EVP_aead_aes_128_ccm_bluetooth_8`, and `EVP_aead_aes_128_ccm_matter` respectively.</p> <p>Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.</p> <p><strong>Affected:</strong> crates.io: aws-lc-fips-sys</p> <p>Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.</p> <p>The impacted implementations are through the EVP CIPHER API: `EVP_aes_128_ccm`, `EVP_aes_192_ccm`, and `EVP_aes_256_ccm`.</p> <p>Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.</p> <p>## Workarounds</p> <p>In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations `EVP_aead_aes_128_ccm_bluetooth`, `EVP_aead_aes_128_ccm_bluetooth_8`, and `EVP_aead_aes_128_ccm_matter` respectively.</p> <p>Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.</p> https://cve.radiocsirt.org/vuln/rustsec-2026-0043