Lucene search
Veracode Vulnerability DatabaseVERACODE:33096HistoryNov 25, 2021 - 11:38 a.m.
Insecure Certificate Validation
2021-11-2511:38:57
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
certificate validation
aws iot
spoofing dns
EPSS
0.002
Percentile
56.3%
aws-iot-device-sdk-v2 uses insecure certificate validation. Attackers are able to compromise certificate authorities in their trust stores on macOS, by spoofing DNS records to bypass CA pinning.
References
http:
github.com/aws/aws-iot-device-sdk-cpp-v2
github.com/aws/aws-iot-device-sdk-java-v2
github.com/aws/aws-iot-device-sdk-js-v2
github.com/aws/aws-iot-device-sdk-js-v2/pull/159
github.com/aws/aws-iot-device-sdk-js-v2/pull/159/commits/f53747afc4170b1fa1ac9a14f372b44b5cd41d2d
github.com/aws/aws-iot-device-sdk-python-v2
github.com/awslabs/aws-c-io/
github.com/awslabs/aws-crt-java/commit/e60484086d1b94750568324a51c0da37d7cc818b
github.com/awslabs/aws-crt-python/commit/2c7b49f5defe5d5f34a01c9c446b96b8d1897908
Related
nvd
nvd
CVE-2021-40831
2021-11-23 00:15:07
ubuntucve
ubuntucve
CVE-2021-40831
2021-11-23 00:00:00
cve
cve
CVE-2021-40831
2021-11-23 00:15:07
prion
prion
Design/Logic Flaw
2021-11-23 00:15:00
osv
osv
CVE-2021-40831
2021-11-23 00:15:07
PYSEC-2021-864
2021-11-23 00:15:00
Improper certificate management in AWS IoT Device SDK v2
2021-11-24 20:35:03
github
github
Improper certificate management in AWS IoT Device SDK v2
2021-11-24 20:35:03
cvelist
cvelist
gitlab
gitlab
Improper Certificate Validation
2021-11-23 00:00:00