RUSTSEC-2026-0047: PKCS7_verify Signature Validation Bypass in AWS-LC

> PKCS7_verify Signature Validation Bypass in AWS-LC

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `aws-lc-sys` |
| Version | `0.35.0` |
| URL | [https://aws.amazon.com/security/security-bulletins/2026-005-AWS](https://aws.amazon.com/security/security-bulletins/2026-005-AWS) |
| Date | 2026-03-02 |
| Patched versions | `>=0.38.0` |
| Unaffected versions | `<0.24.0` |

Improper signature validation in `PKCS7_verify()` in AWS-LC allows an
unauthenticated user to bypass signature verification when processing PKCS7
objects with Authenticated Attributes.

Customers of AWS services do not need to take action. `aws-lc-sys` contains
code from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most
recent release of `aws-lc-sys`.

There is no workaround; applications using `aws-lc-sys` should upgrade to the
most recent release of `aws-lc-sys`.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0047.html) for additional details.

Search the repository for the aws-lc-sys dependency declaration and confirm the affected version is in use. Update it to version 0.38.0 or newer, refresh the lockfile if present, and run the project's existing tests to verify the dependency upgrade does not break the sample.

Written by the indexing model from the issue text.