CVE-2021-40828

CVE-2021-40828 affects AWS IoT Device SDK v2 on Windows prior to specific versions: Java < 1.3.3, Python < 1.5.18, C++ < 1.12.7, Node.js

CVE-2021-40830

CVE-2021-40830 affects the AWS IoT Device SDK v2 for Java, Python, C++, and Node.js on Linux/Unix. The root cause is that the SDK appends a user-supplied CA to the system trust store instead of overriding it, which can allow TLS handshakes to succeed using either the user-supplied CA or the defau...

CVE-2021-40831

The CVE-2021-40831 issue affects AWS IoT Device SDK v2 for Java, Python, C++ and Node.js on macOS. The product appends a user-supplied CA to the root trust store instead of overriding it, and SNI validation is not enabled when the CA is overridden. TLS handshakes may succeed if the peer is verifi...