Is CVE-2021-40829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-40829 being exploited in the wild.

How severe is CVE-2021-40829?

Low severity, with a CVSS score of 3.1, published 23 November 2021.

Which products and versions are affected?

Amazon Web Services AWS IoT Device SDK v2 for C++ prior to 1.12.7 on macOS; Amazon Web Services AWS IoT Device SDK v2 for Java prior to 1.4.2 on macOS; Amazon Web Services AWS IoT Device SDK v2 for Node.js prior to 1.5.3 on macOS; Amazon Web Services AWS IoT Device SDK v2 for Python prior to 1.6.1 on macOS; and 4 more.

Is there a fix for CVE-2021-40829?

Yes. software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.4.2 or later; aws-iot-device-sdk-v2 (npm): upgrade to 1.5.3 or later; awsiotsdk (PyPI): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-40829 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2021-40829?

Check whether you run Amazon Web Services AWS IoT Device SDK v2 for C++, Amazon Web Services AWS IoT Device SDK v2 for Java, Amazon Web Services AWS IoT Device SDK v2 for Node.js or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-40829: AWS IoT Device SDK v2 hostname verification bypass on macOS

CVE-2021-40829 · Severity: low · CVSS 3.1 · Published 2021-11-23

The AWS IoT Device SDK v2 (used by applications to securely connect to AWS IoT services) failed to properly verify server certificate hostnames during TLS handshakes when custom certificate authorities were configured on macOS systems. An attacker with network access could intercept connections and present a valid but unrelated certificate, allowing them to eavesdrop on or tamper with sensitive IoT communications.

Technologies: Amazon Web Services AWS IoT Device SDK v2 for C++, Amazon Web Services AWS IoT Device SDK v2 for Java, Amazon Web Services AWS IoT Device SDK v2 for Node.js, Amazon Web Services AWS IoT Device SDK v2 for Python, Amazon Web Services Aws-C-Io, software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven), aws-iot-device-sdk-v2 (npm), awsiotsdk (PyPI). Vendors: Amazon Web Services, Maven, npm, PyPI.

Quick answers

Is CVE-2021-40829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-40829 being exploited in the wild.
How severe is CVE-2021-40829?: Low severity, with a CVSS score of 3.1, published 23 November 2021.
Which products and versions are affected?: Amazon Web Services AWS IoT Device SDK v2 for C++ prior to 1.12.7 on macOS; Amazon Web Services AWS IoT Device SDK v2 for Java prior to 1.4.2 on macOS; Amazon Web Services AWS IoT Device SDK v2 for Node.js prior to 1.5.3 on macOS; Amazon Web Services AWS IoT Device SDK v2 for Python prior to 1.6.1 on macOS; and 4 more.
Is there a fix for CVE-2021-40829?: Yes. software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.4.2 or later; aws-iot-device-sdk-v2 (npm): upgrade to 1.5.3 or later; awsiotsdk (PyPI): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-40829 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2021-40829?: Check whether you run Amazon Web Services AWS IoT Device SDK v2 for C++, Amazon Web Services AWS IoT Device SDK v2 for Java, Amazon Web Services AWS IoT Device SDK v2 for Node.js or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.4.2 or later

# set software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk to 1.4.2 in your pom.xml or build.gradle

aws-iot-device-sdk-v2 (npm): upgrade to 1.5.3 or later
```
npm install aws-iot-device-sdk-v2@1.5.3
```
awsiotsdk (PyPI): upgrade to 1.6.1 or later
```
pip install "awsiotsdk>=1.6.1"
```

Technical details

The vulnerability is a certificate hostname verification bypass (CWE-295) in the TLS handshake implementation for Java, Python, C++, and Node.js versions of AWS IoT Device SDK v2 on macOS. When users overrode the default Certificate Authority (CA) trust store, the SDK failed to validate that the server's certificate hostname matched the intended connection target. An attacker on the network (adjacent or network-accessible, depending on deployment) could perform a man-in-the-middle attack by presenting a valid certificate signed by a trusted CA but for a different hostname, gaining read/write access to IoT device communications. The fix was delivered via the aws-c-io submodule version 0.10.5 and incorporated into patched SDK versions (Java 1.4.2, Python 1.6.1, C++ 1.12.7, Node.js 1.5.3).

Affected products

Amazon Web Services AWS IoT Device SDK v2 for Java prior to 1.4.2 on macOS
Amazon Web Services AWS IoT Device SDK v2 for Python prior to 1.6.1 on macOS
Amazon Web Services AWS IoT Device SDK v2 for C++ prior to 1.12.7 on macOS
Amazon Web Services AWS IoT Device SDK v2 for Node.js prior to 1.5.3 on macOS
Amazon Web Services aws-c-io 0.10.4 on macOS

Identifiers

CVE-2021-40829
GHSA-743r-5g92-5vgf
PYSEC-2021-862

Timeline

2021-11-24: disclosed: Published to GitHub Advisory Database
2021-11-24: patched: Patches released: Java 1.4.2, Python 1.6.1, C++ 1.12.7, Node.js 1.5.3; aws-c-io 0.10.5+

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.