CVE-2021-40829: TLS hostname validation issues within AWS IoT Device SDKs on macOS
First published: Mon Nov 22 2021(Updated: )
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Credit: cve-notifications-us@f-secure.com cve-notifications-us@f-secure.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.4.2 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.5.3 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.6.1 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.12.7 | |
| Apple macOS | ||
| pip/awsiotsdk | <1.6.1 | 1.6.1 |
| npm/aws-iot-device-sdk-v2 | <1.5.3 | 1.5.3 |
| maven/software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk | <1.4.2 | 1.4.2 |
| All of | ||
| Any of | ||
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.4.2 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.5.3 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.6.1 | |
| Amazon Amazon Web Services Internet Of Things Device Software Development Kit V2 | <1.12.7 | |
| Apple macOS |
Remedy
Update to the latest versions of the AWS IoT Device SDK.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/aws/aws-iot-device-sdk-cpp-v2
- https://github.com/aws/aws-iot-device-sdk-java-v2
- https://github.com/aws/aws-iot-device-sdk-js-v2
- https://github.com/aws/aws-iot-device-sdk-python-v2
- https://github.com/awslabs/aws-c-io/
- https://nvd.nist.gov/vuln/detail/CVE-2021-40829
- https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2
- https://github.com/advisories/GHSA-743r-5g92-5vgf (Advisory)
- https://github.com/awslabs/aws-c-io
- https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml
Frequently Asked Questions
What is CVE-2021-40829?
CVE-2021-40829 is a vulnerability that affects the AWS IoT Device SDK v2 for Java, Python, C++, and Node.js. It allows connections to be made without verifying the server certificate hostname during TLS handshake.
How severe is CVE-2021-40829?
CVE-2021-40829 has a severity rating of 8.8 (high).
Which versions of the AWS IoT Device SDK v2 are affected by CVE-2021-40829?
Versions of the AWS IoT Device SDK v2 prior to 1.4.2 for Java, prior to 1.6.1 for Python, prior to 1.12.7 for C++, and prior to 1.5.3 for Node.js are affected by CVE-2021-40829.
How does CVE-2021-40829 exploit the vulnerability?
CVE-2021-40829 allows connections to be established without verifying the server certificate hostname during TLS handshake, which could lead to man-in-the-middle attacks.
How can I fix CVE-2021-40829?
To fix CVE-2021-40829, update your AWS IoT Device SDK v2 to version 1.4.2 or later for Java, 1.6.1 or later for Python, 1.12.7 or later for C++, and 1.5.3 or later for Node.js.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/severity
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-743r-5g92-5vgf
- alias/CVE-2021-40829
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/references
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- vendor/amazon
- canonical/amazon amazon web services internet of things device software development kit v2
- vendor/apple
- canonical/apple macos
- package-manager/pip
- package-manager/npm
- package-manager/maven