CVE-2021-40828

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-40828
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40828.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-40828
Aliases
Withdrawn
2024-09-03T02:21:54.219963Z
Published
2021-11-23T00:15:07Z
Modified
2024-09-02T01:12:39.020156Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

References

Affected packages

Git / github.com/aws/aws-iot-device-sdk-cpp-v2

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-iot-device-sdk-cpp-v2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
de204d4ac40ffcb7bc075363a4a118d264aebf47
Type
GIT
Repo
https://github.com/aws/aws-iot-device-sdk-java-v2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
67950ad2a02f2f9355c310b69dc9226b017f32f2
Type
GIT
Repo
https://github.com/aws/aws-iot-device-sdk-js-v2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c31135846eb086e851428df3ec6bbe620918e569
Type
GIT
Repo
https://github.com/aws/aws-iot-device-sdk-python-v2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6c33ae9534428858f5739ab8a6ff8e6beb90f7ab

Affected versions

0.*

0.2.2
0.2.3
0.2.4
0.2.5

1.*

1.2.11
1.2.8
1.2.9
1.3.0

v0.*

v0.1.1
v0.1.2
v0.1.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.2
v0.3.3

v1.*

v1.0
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1
v1.1.0
v1.1.1
v1.2
v1.2.0
v1.2.1
v1.2.10
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.3
v1.3.0
v1.3.1
v1.3.2
v1.4
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0