CVE-2021-40829: TLS hostname validation issues within AWS IoT Device SDKs on macOS
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-40829?
CVE-2021-40829 is a vulnerability that affects the AWS IoT Device SDK v2 for Java, Python, C++, and Node.js. It allows connections to be made without verifying the server certificate hostname during TLS handshake.
How severe is CVE-2021-40829?
CVE-2021-40829 has a severity rating of 8.8 (high).
Which versions of the AWS IoT Device SDK v2 are affected by CVE-2021-40829?
Versions of the AWS IoT Device SDK v2 prior to 1.4.2 for Java, prior to 1.6.1 for Python, prior to 1.12.7 for C++, and prior to 1.5.3 for Node.js are affected by CVE-2021-40829.
How does CVE-2021-40829 exploit the vulnerability?
CVE-2021-40829 allows connections to be established without verifying the server certificate hostname during TLS handshake, which could lead to man-in-the-middle attacks.
How can I fix CVE-2021-40829?
To fix CVE-2021-40829, update your AWS IoT Device SDK v2 to version 1.4.2 or later for Java, 1.6.1 or later for Python, 1.12.7 or later for C++, and 1.5.3 or later for Node.js.