Lucene search

[email protected]CVE-2021-40829

HistoryNov 23, 2021 - 12:15 a.m.

CVE-2021-40829

2021-11-2300:15:07

CWE-295

[email protected]

web.nvd.nist.gov

aws

iot

device sdk

java

python

c++

node.js

macos

tls

certificate

security

vulnerability

cve-2021-40829

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

40.0%

JSON

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.

Affected configurations

NVD

Node

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.4.2java

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.5.3node.js

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.6.1python

amazonamazon_web_services_internet_of_things_device_software_development_kit_v2Range<1.12.7c\+\+

AND

applemacosMatch-

CPENameOperatorVersion
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.4.2
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.5.3
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.6.1
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2amazon amazon web services internet of things device software development kit v2lt1.12.7

CPE	Name	Operator	Version
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.4.2
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.5.3
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.6.1
amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2	amazon amazon web services internet of things device software development kit v2	lt	1.12.7

CNA Affected

[
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for Java ",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for Python",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.6.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for C++",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.12.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS IoT Device SDK v2 for Node.js",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "1.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "macOS"
    ],
    "product": "AWS-C-IO",
    "vendor": "Amazon Web Services",
    "versions": [
      {
        "lessThan": "0.10.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]