Lucene search

[email protected]CVE-2021-40828

HistoryNov 23, 2021 - 12:15 a.m.

CVE-2021-40828

2021-11-2300:15:07

CWE-295

[email protected]

web.nvd.nist.gov

aws iot

sdk v2

java

python

c++

node.js

tls handshake

hostname verification

cve-2021-40828

nvd

security issue

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

40.0%

JSON

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

Affected configurations

NVD

Node

amazonamazon_web_services_aws-c-ioRange<0.9.13

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.3.3java

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.5.1node.js

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.5.18python

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.12.7c\+\+

AND

microsoftwindowsMatch-

CPENameOperatorVersion
amazon:amazon_web_services_aws-c-ioamazon amazon web services aws-c-iolt0.9.13
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.3.3
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.5.1
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.5.18
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.12.7

CPE	Name	Operator	Version
amazon:amazon_web_services_aws-c-io	amazon amazon web services aws-c-io	lt	0.9.13
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.3.3
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.5.1
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.5.18
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.12.7

CNA Affected

[
  {
    "platforms": [
      "Microsoft Windows"
    ],
    "product": "AWS IoT Device SDK v2 for Java ",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.3.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Microsoft Windows"
    ],
    "product": "AWS IoT Device SDK v2 for Python",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.5.18",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Microsoft Windows"
    ],
    "product": "AWS IoT Device SDK v2 for C++",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.12.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Microsoft Windows"
    ],
    "product": "AWS IoT Device SDK v2 for Node.js",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Microsoft Windows"
    ],
    "product": "AWS-C-IO",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "status": "affected",
        "version": "0.9.12"
      }
    ]
  }
]