TLS hostname validation issues within AWS IoT Device SDKs on macOS
Priority LOW 38CWE-295Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Why it matters now
EPSS 0.00387 33rd percentileScored 2026-11-07
Fix Fixed AWS IoT Device SDK v2 for Java (Amazon Web Services): 1.4.2AWS IoT Device SDK v2 for Python (Amazon Web Services): 1.6.1+6 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | AWS IoT Device SDK v2 for Java | before 1.4.2 | 1.4.2 | Patch available | CNA |
| AWS | AWS IoT Device SDK v2 for Python | before 1.6.1 | 1.6.1 | Patch available | CNA |
| AWS | AWS IoT Device SDK v2 for C++ | before 1.12.7 | 1.12.7 | Patch available | CNA |
| AWS | AWS IoT Device SDK v2 for Node.js | before 1.5.3 | 1.5.3 | Patch available | CNA |
| AWS | AWS-C-IO | before 0.10.4 | 0.10.4 | Patch available | CNA |
| — | software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) | before 1.4.2 | 1.4.2 | Patch available | GHSA-743r-5g92-5vgf |
| — | aws-iot-device-sdk-v2 (npm) | before 1.5.3 | 1.5.3 | Patch available | GHSA-743r-5g92-5vgf |
| — | awsiotsdk (PyPI) | before 1.6.1 | 1.6.1 | Patch available | GHSA-743r-5g92-5vgf |
- AWS IoT Device SDK v2 for Java VendorAWS Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA
- AWS IoT Device SDK v2 for Python VendorAWS Affected before 1.6.1 Fixed in 1.6.1 Patch available CNA
- AWS IoT Device SDK v2 for C++ VendorAWS Affected before 1.12.7 Fixed in 1.12.7 Patch available CNA
- AWS IoT Device SDK v2 for Node.js VendorAWS Affected before 1.5.3 Fixed in 1.5.3 Patch available CNA
- AWS-C-IO VendorAWS Affected before 0.10.4 Fixed in 0.10.4 Patch available CNA
- software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-743r-5g92-5vgf
- aws-iot-device-sdk-v2 (npm) Vendor— Affected before 1.5.3 Fixed in 1.5.3 Patch available GHSA-743r-5g92-5vgf
- awsiotsdk (PyPI) Vendor— Affected before 1.6.1 Fixed in 1.6.1 Patch available GHSA-743r-5g92-5vgf
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:* | before 1.4.2 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:* | before 1.5.3 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:* | before 1.6.1 | Vulnerable | AWS |
| cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:* | before 1.12.7 | Vulnerable | AWS |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:* Versions before 1.4.2 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:* Versions before 1.5.3 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:* Versions before 1.6.1 Vulnerable ·AWS
- cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:* Versions before 1.12.7 Vulnerable ·AWS
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
Remediation
- Fix · CNA AWS IoT Device SDK v2 for Java (Amazon Web Services) Fixed in 1.4.2
- Fix · CNA AWS IoT Device SDK v2 for Python (Amazon Web Services) Fixed in 1.6.1
- Fix · CNA AWS IoT Device SDK v2 for C++ (Amazon Web Services) Fixed in 1.12.7
- Fix · CNA AWS IoT Device SDK v2 for Node.js (Amazon Web Services) Fixed in 1.5.3
- Fix · CNA AWS-C-IO (Amazon Web Services) Fixed in 0.10.4
- Fix · GHSA-743r-5g92-5vgf software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Fixed in 1.4.2 Advisory →
- Fix · GHSA-743r-5g92-5vgf aws-iot-device-sdk-v2 (npm) Fixed in 1.5.3 Advisory →
- Fix · GHSA-743r-5g92-5vgf awsiotsdk (PyPI) Fixed in 1.6.1 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Amazon Web Services AWS IoT Device SDK v2 for C++, AWS IoT Device SDK v2 for Node.js 1.12.7, 1.5.3
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsPriority LOW 38
- TI-2021-17753 TLS hostname validation issues within AWS IoT Device SDKs on WindowsPriority LOW 38
- Release ·
Amazon Web Services AWS IoT Device SDK v2 for Python 1.6.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsPriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40829
- 2026-10-03 Alias added: GHSA-743r-5g92-5vgf
References
Advisory 2
Other 8
- https://github.com/awslabs/aws-c-io/
- https://github.com/aws/aws-iot-device-sdk-cpp-v2
- https://github.com/aws/aws-iot-device-sdk-python-v2
- https://github.com/aws/aws-iot-device-sdk-java-v2
- https://github.com/aws/aws-iot-device-sdk-js-v2
- https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2
- https://github.com/awslabs/aws-c-io
- https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml
More AWS Amazon Web Services Internet Of Things Device Software Development Kit V2 vulnerabilities
- TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems CVSS 3.1HIGH 8.8
- TI-2021-17753 TLS hostname validation issues within AWS IoT Device SDKs on Windows CVSS 3.1HIGH 8.8
- TI-2021-17756 Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices CVSS 3.1HIGH 7.2
Sources
- CVE-2021-40829 · CVE Program
- CVE-2021-40829 · NVD
- FIRST EPSS
- GHSA-743r-5g92-5vgf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences