High severity · published Nov 23, 2021
CVE-2021-40829
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Amazon Web Services Internet OF Things Device Software Development Kit V2 · Amazon
before 1.4.2; before 1.5.3; before 1.6.1; before 1.12.7 · source: NVD
Affected product
AW
Amazon Web Services Internet OF Things Device Software Development Kit V2
Amazon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40829
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40829
Product
https://github.com/aws/aws-iot-device-sdk-cpp-v2
Product
https://github.com/aws/aws-iot-device-sdk-java-v2
Product
https://github.com/aws/aws-iot-device-sdk-js-v2
Product
https://github.com/aws/aws-iot-device-sdk-python-v2
Product
https://github.com/awslabs/aws-c-io/
More from Amazon Web Services Internet OF Things Device Software Development Kit V2
8.8
CVE-2021-40830
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems
8.8
CVE-2021-40828
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions…
7.2
CVE-2021-40831
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems