High severity · published Nov 23, 2021
CVE-2021-40828
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Amazon Web Services Aws-c-io · Amazon
before 0.9.13 · source: NVD
AW
Amazon Web Services Internet OF Things Device Software Development Kit V2 · Amazon
before 1.3.3; before 1.5.1; before 1.5.18; before 1.12.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40828
Product
https://github.com/aws/aws-iot-device-sdk-cpp-v2
Product
https://github.com/aws/aws-iot-device-sdk-java-v2
Product
https://github.com/aws/aws-iot-device-sdk-js-v2
Product
https://github.com/aws/aws-iot-device-sdk-python-v2
Product
https://github.com/awslabs/aws-c-io/
More from Amazon Web Services Aws-c-io
8.8
CVE-2021-40830
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems
7.2
CVE-2021-40831
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems