CVE-2021-40829

🗓️ 22 Nov 2021 23:41:17Reported by F-SecureUSType

AWS IoT Device SDK v2 for Java, Python, C++ and Node.js did not verify server certificate hostname during TLS handshake overriding CAs on MacOS. Fixed in aws-c-io 0.10.5 onwards

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2021-40829	23 Nov 202102:20	–	circl
CNNVD	Amazon AWS IoT Device SDK 信任管理问题漏洞	23 Nov 202100:00	–	cnnvd
Cvelist	CVE-2021-40829 TLS hostname validation issues within AWS IoT Device SDKs on macOS	22 Nov 202123:41	–	cvelist
EUVD	EUVD-2021-0029	7 Oct 202500:30	–	euvd
Github Security Blog	Improper certificate management in AWS IoT Device SDK v2	24 Nov 202121:11	–	github
GitLab Advisory Database	Improper Certificate Validation	23 Nov 202100:00	–	gitlab
NVD	CVE-2021-40829	23 Nov 202100:15	–	nvd
OSV	GHSA-743R-5G92-5VGF Improper certificate management in AWS IoT Device SDK v2	24 Nov 202121:11	–	osv
OSV	PYSEC-2021-862	23 Nov 202100:15	–	osv
Prion	Code injection	23 Nov 202100:15	–	prion

NVD

Node

amazon amazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.4.2java

amazon amazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.5.3node.js

amazon amazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.6.1python

amazon amazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.12.7c++

AND

apple macosMatch-

[
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for Java",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for Python",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.6.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for C++",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.12.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for Node.js",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS-C-IO",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "0.10.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/aws/aws-iot-device-sdk-js-v2
github	www.github.com/awslabs/aws-c-io/
github	www.github.com/aws/aws-iot-device-sdk-java-v2
github	www.github.com/aws/aws-iot-device-sdk-python-v2
github	www.github.com/aws/aws-iot-device-sdk-cpp-v2

21 Nov 2024 06:24Current

7.2High risk

Vulners AI Score7.2

CVSS 25.8

CVSS 3.16.3 - 8.8

EPSS0.00102

CWE-295