CVE-2021-40828: TLS hostname validation issues within AWS IoT Device SDKs on Windows
First published: Mon Nov 22 2021(Updated: )
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
Credit: cve-notifications-us@f-secure.com cve-notifications-us@f-secure.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Amazon Web Services Aws-c-io | <0.9.13 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.3.3 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.5.1 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.5.18 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.12.7 | |
| Microsoft Windows | ||
| pip/awsiotsdk | <1.5.18 | 1.5.18 |
| npm/aws-iot-device-sdk-v2 | <1.5.1 | 1.5.1 |
| maven/software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk | <1.3.3 | 1.3.3 |
| All of | ||
| Any of | ||
| Amazon Amazon Web Services Aws-c-io | <0.9.13 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.3.3 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.5.1 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.5.18 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.12.7 | |
| Microsoft Windows |
Remedy
Update to the latest versions of the AWS IoT Device SDK.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/aws/aws-iot-device-sdk-cpp-v2
- https://github.com/aws/aws-iot-device-sdk-java-v2
- https://github.com/aws/aws-iot-device-sdk-js-v2
- https://github.com/aws/aws-iot-device-sdk-python-v2
- https://github.com/awslabs/aws-c-io/
- https://nvd.nist.gov/vuln/detail/CVE-2021-40828
- https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2
- https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d
- https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be
- https://github.com/advisories/GHSA-94jq-q5v2-76wj (Advisory)
- https://github.com/awslabs/aws-c-io
- https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml
Frequently Asked Questions
What is CVE-2021-40828?
CVE-2021-40828 is a vulnerability that allows connections initialized by the AWS IoT Device SDK v2 for Java, Python, C++, and Node.js to not verify the server certificate hostname during TLS handshake when overriding Certificate Authorities.
Which software versions are affected by CVE-2021-40828?
Versions prior to 1.3.3 of AWS IoT Device SDK v2 for Java, versions prior to 1.5.18 of Python, versions prior to 1.12.7 of C++, and versions prior to 1.5.1 of Node.js are affected by CVE-2021-40828.
What is the severity of CVE-2021-40828?
CVE-2021-40828 has a severity rating of 8.8 out of 10, which is considered high.
How can I fix CVE-2021-40828?
To fix CVE-2021-40828, it is recommended to update the affected AWS IoT Device SDK v2 versions to 1.3.3 for Java, 1.5.18 for Python, 1.12.7 for C++, and 1.5.1 for Node.js.
Where can I find more information about CVE-2021-40828?
More information about CVE-2021-40828 can be found on the following GitHub repositories: [AWS IoT Device SDK for C++](https://github.com/aws/aws-iot-device-sdk-cpp-v2), [AWS IoT Device SDK for Java](https://github.com/aws/aws-iot-device-sdk-java-v2), and [AWS IoT Device SDK for Node.js](https://github.com/aws/aws-iot-device-sdk-js-v2).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/severity
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-94jq-q5v2-76wj
- alias/CVE-2021-40828
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- vendor/amazon
- canonical/amazon amazon web services aws-c-io
- canonical/amazon amazon web services internet of things device software development kit v2
- vendor/microsoft
- canonical/microsoft windows
- package-manager/pip
- package-manager/npm
- package-manager/maven