TLS hostname validation issues within AWS IoT Device SDKs on Windows
Priority LOW 38CWE-295Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
Why it matters now
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Fixed AWS IoT Device SDK v2 for Java (Amazon Web Services): 1.3.3AWS IoT Device SDK v2 for Python (Amazon Web Services): 1.5.18+5 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | AWS IoT Device SDK v2 for Java | before 1.3.3 | 1.3.3 | Patch available | CNA |
| AWS | AWS IoT Device SDK v2 for Python | before 1.5.18 | 1.5.18 | Patch available | CNA |
| AWS | AWS IoT Device SDK v2 for C++ | before 1.12.7 | 1.12.7 | Patch available | CNA |
| AWS | AWS IoT Device SDK v2 for Node.js | before 1.5.3 | 1.5.3 | Patch available | CNA |
| AWS | AWS-C-IO | 0.9.12 | — | No fix listed | CNA |
| — | software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) | before 1.3.3 | 1.3.3 | Patch available | GHSA-94jq-q5v2-76wj |
| — | aws-iot-device-sdk-v2 (npm) | before 1.5.1 | 1.5.1 | Patch available | GHSA-94jq-q5v2-76wj |
| — | awsiotsdk (PyPI) | before 1.5.18 | 1.5.18 | Patch available | GHSA-94jq-q5v2-76wj |
- AWS IoT Device SDK v2 for Java VendorAWS Affected before 1.3.3 Fixed in 1.3.3 Patch available CNA
- AWS IoT Device SDK v2 for Python VendorAWS Affected before 1.5.18 Fixed in 1.5.18 Patch available CNA
- AWS IoT Device SDK v2 for C++ VendorAWS Affected before 1.12.7 Fixed in 1.12.7 Patch available CNA
- AWS IoT Device SDK v2 for Node.js VendorAWS Affected before 1.5.3 Fixed in 1.5.3 Patch available CNA
- AWS-C-IO VendorAWS Affected 0.9.12 Fixed in — No fix listed CNA
- software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Vendor— Affected before 1.3.3 Fixed in 1.3.3 Patch available GHSA-94jq-q5v2-76wj
- aws-iot-device-sdk-v2 (npm) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-94jq-q5v2-76wj
- awsiotsdk (PyPI) Vendor— Affected before 1.5.18 Fixed in 1.5.18 Patch available GHSA-94jq-q5v2-76wj
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amazon:amazon_web_services_aws-c-io:*:*:*:*:*:*:*:* | before 0.9.13 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:* | before 1.3.3 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:* | before 1.5.1 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:* | before 1.5.18 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:* | before 1.12.7 | Vulnerable | AWS |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:amazon:amazon_web_services_aws-c-io:*:*:*:*:*:*:*:* Versions before 0.9.13 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:* Versions before 1.3.3 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:* Versions before 1.5.1 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:* Versions before 1.5.18 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:* Versions before 1.12.7 Vulnerable ·AWS
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA AWS IoT Device SDK v2 for Java (Amazon Web Services) Fixed in 1.3.3
- Fix · CNA AWS IoT Device SDK v2 for Python (Amazon Web Services) Fixed in 1.5.18
- Fix · CNA AWS IoT Device SDK v2 for C++ (Amazon Web Services) Fixed in 1.12.7
- Fix · CNA AWS IoT Device SDK v2 for Node.js (Amazon Web Services) Fixed in 1.5.3
- Fix · GHSA-94jq-q5v2-76wj software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Fixed in 1.3.3 Advisory →
- Fix · GHSA-94jq-q5v2-76wj aws-iot-device-sdk-v2 (npm) Fixed in 1.5.1 Advisory →
- Fix · GHSA-94jq-q5v2-76wj awsiotsdk (PyPI) Fixed in 1.5.18 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Amazon Web Services AWS IoT Device SDK v2 for C++, AWS IoT Device SDK v2 for Node.js 1.12.7, 1.5.3
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsPriority LOW 38
- TI-2021-17754 TLS hostname validation issues within AWS IoT Device SDKs on macOSPriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40828
- 2026-10-03 Alias added: GHSA-94jq-q5v2-76wj
References
Advisory 2
Other 10
- https://github.com/awslabs/aws-c-io/
- https://github.com/aws/aws-iot-device-sdk-cpp-v2
- https://github.com/aws/aws-iot-device-sdk-python-v2
- https://github.com/aws/aws-iot-device-sdk-java-v2
- https://github.com/aws/aws-iot-device-sdk-js-v2
- https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2
- https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d
- https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be
- https://github.com/awslabs/aws-c-io
- https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml
More AWS Amazon Web Services Aws-c-io vulnerabilities
- TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems CVSS 3.1HIGH 8.8
- TI-2021-17756 Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices CVSS 3.1HIGH 7.2
Sources
- CVE-2021-40828 · CVE Program
- CVE-2021-40828 · NVD
- FIRST EPSS
- GHSA-94jq-q5v2-76wj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences