PYSEC-2021-861: High severity Amazon Web Services AWS IoT Device SDK v2 for Java vulnerability

Q: Which deployments are exposed?

The issue is limited to applications running on Microsoft Windows that use an affected AWS IoT Device SDK v2 version and override the CA certificates in their TLS trust store. The described hostname-verification failure does not apply unless the trust store CA override is used.

Q: What would an attacker need to exploit this?

The vulnerability has adjacent-network attack vector, requires no privileges, and requires no user interaction. Exploitation concerns TLS connections where hostname verification is skipped while using an overridden CA trust store.

Q: Which versions should be updated?

Update the Java SDK to 1.3.3 or later, Python to 1.5.18 or later, and C++ to 1.12.7 or later. For Node.js, the affected-products list identifies versions prior to 1.5.3; the underlying aws-c-io fix is available in version 0.9.13 onward.

Q: How can I determine whether I am already affected?

Review Windows applications using the Java, Python, C++, or Node.js AWS IoT Device SDK v2, identify their installed SDK version, and check whether they override the default CA trust store. A deployment meeting both conditions should be treated as affected if its SDK version is below the applicable fixed version.

Published Nov 23, 2021

Updated

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

Affected Software

5 affected components

Amazon Web Services AWS IoT Device SDK v2 for Java<1.3.3

Amazon Web Services AWS IoT Device SDK v2 for Python<1.5.18

Amazon Web Services AWS IoT Device SDK v2 for C++<1.12.7

Amazon Web Services AWS IoT Device SDK v2 for Node.js<1.5.3

Amazon Web Services aws-c-io<0.9.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade AWS IoT Device SDK v2 for C++ to a version that resolves this vulnerability.
Fixed in 1.12.7
Upgrade
Upgrade AWS IoT Device SDK v2 for Node.js to a version that resolves this vulnerability.
Fixed in 1.5.3
Upgrade
Upgrade AWS IoT Device SDK v2 for Python to a version that resolves this vulnerability.
Fixed in 1.5.18
Upgrade
Upgrade AWS IoT Device SDK v2 for Java to a version that resolves this vulnerability.
Fixed in 1.3.3
Upgrade
Upgrade aws-c-io to a version that resolves this vulnerability.
Fixed in 0.9.13

Event History

Nov 23, 2021

CVE Published

via OSV·12:15 AM

Data Sourced

via OSV·12:15 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed?

The issue is limited to applications running on Microsoft Windows that use an affected AWS IoT Device SDK v2 version and override the CA certificates in their TLS trust store. The described hostname-verification failure does not apply unless the trust store CA override is used.

What would an attacker need to exploit this?

The vulnerability has adjacent-network attack vector, requires no privileges, and requires no user interaction. Exploitation concerns TLS connections where hostname verification is skipped while using an overridden CA trust store.

Which versions should be updated?

Update the Java SDK to 1.3.3 or later, Python to 1.5.18 or later, and C++ to 1.12.7 or later. For Node.js, the affected-products list identifies versions prior to 1.5.3; the underlying aws-c-io fix is available in version 0.9.13 onward.

How can I determine whether I am already affected?

Review Windows applications using the Java, Python, C++, or Node.js AWS IoT Device SDK v2, identify their installed SDK version, and check whether they override the default CA trust store. A deployment meeting both conditions should be treated as affected if its SDK version is below the applicable fixed version.

PYSEC-2021-861: High severity Amazon Web Services AWS IoT Device SDK v2 for Java vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What would an attacker need to exploit this?

Which versions should be updated?

How can I determine whether I am already affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What would an attacker need to exploit this?

Which versions should be updated?

How can I determine whether I am already affected?