Read the docs
TI-2021-17755 Aliases CVE-2021-40830GHSA-c4rh-4376-gff4

Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems

Priority LOW 38CWE-295Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.

Why it matters now

EPSS 0.00387 33rd percentileScored 2026-11-07
Fix Fixed AWS IoT Device SDK v2 for Java (Amazon Web Services): 1.5.0AWS IoT Device SDK v2 for Python (Amazon Web Services): 1.6.1+5 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSAWS IoT Device SDK v2 for Javabefore 1.5.01.5.0Patch availableCNA
AWSAWS IoT Device SDK v2 for Pythonbefore 1.6.11.6.1Patch availableCNA
AWSAWS IoT Device SDK v2 for C++before 1.12.71.12.7Patch availableCNA
AWSAWS IoT Device SDK v2 for Node.jsbefore 1.5.31.5.3Patch availableCNA
AWSAWS-C-IO0.10.4—No fix listedCNA
—software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven)before 1.5.01.5.0Patch availableGHSA-c4rh-4376-gff4
—aws-iot-device-sdk-v2 (npm)before 1.5.31.5.3Patch availableGHSA-c4rh-4376-gff4
—awsiotsdk (PyPI)before 1.6.11.6.1Patch availableGHSA-c4rh-4376-gff4
  • AWS IoT Device SDK v2 for Java VendorAWS Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
  • AWS IoT Device SDK v2 for Python VendorAWS Affected before 1.6.1 Fixed in 1.6.1 Patch available CNA
  • AWS IoT Device SDK v2 for C++ VendorAWS Affected before 1.12.7 Fixed in 1.12.7 Patch available CNA
  • AWS IoT Device SDK v2 for Node.js VendorAWS Affected before 1.5.3 Fixed in 1.5.3 Patch available CNA
  • AWS-C-IO VendorAWS Affected 0.10.4 Fixed in — No fix listed CNA
  • software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-c4rh-4376-gff4
  • aws-iot-device-sdk-v2 (npm) Vendor— Affected before 1.5.3 Fixed in 1.5.3 Patch available GHSA-c4rh-4376-gff4
  • awsiotsdk (PyPI) Vendor— Affected before 1.6.1 Fixed in 1.6.1 Patch available GHSA-c4rh-4376-gff4

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:amazon:amazon_web_services_aws-c-io:0.10.4:*:*:*:*:*:*:*0.10.4VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:*before 1.5.0VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:*before 1.5.3VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:*before 1.6.1VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:*before 1.12.7VulnerableAWS
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*not specified by NVDRunning onOpengroup
  • cpe:2.3:a:amazon:amazon_web_services_aws-c-io:0.10.4:*:*:*:*:*:*:* Versions 0.10.4 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:* Versions before 1.5.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:* Versions before 1.5.3 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:* Versions before 1.6.1 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:* Versions before 1.12.7 Vulnerable ·AWS
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Opengroup

Remediation

  • Fix · CNA AWS IoT Device SDK v2 for Java (Amazon Web Services) Fixed in 1.5.0
  • Fix · CNA AWS IoT Device SDK v2 for Python (Amazon Web Services) Fixed in 1.6.1
  • Fix · CNA AWS IoT Device SDK v2 for C++ (Amazon Web Services) Fixed in 1.12.7
  • Fix · CNA AWS IoT Device SDK v2 for Node.js (Amazon Web Services) Fixed in 1.5.3
  • Fix · GHSA-c4rh-4376-gff4 software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Fixed in 1.5.0 Advisory →
  • Fix · GHSA-c4rh-4376-gff4 aws-iot-device-sdk-v2 (npm) Fixed in 1.5.3 Advisory →
  • Fix · GHSA-c4rh-4376-gff4 awsiotsdk (PyPI) Fixed in 1.6.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Amazon Web Services AWS IoT Device SDK v2 for C++, AWS IoT Device SDK v2 for Node.js 1.12.7, 1.5.3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2021-17754 TLS hostname validation issues within AWS IoT Device SDKs on macOSPriority LOW 38
    • TI-2021-17753 TLS hostname validation issues within AWS IoT Device SDKs on WindowsPriority LOW 38
    Show all 3 records →
  • Release ·

    Amazon Web Services AWS IoT Device SDK v2 for Java 1.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-17756 Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devicesPriority LOW 33
    Show all 2 records →
Show 1 more group
  • Release ·

    Amazon Web Services AWS IoT Device SDK v2 for Python 1.6.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-17754 TLS hostname validation issues within AWS IoT Device SDKs on macOSPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40830
  2. 2026-10-03 Alias added: GHSA-c4rh-4376-gff4

References

Advisory 2

Other 10

  • TI-2021-17753 TLS hostname validation issues within AWS IoT Device SDKs on Windows CVSS 3.1HIGH 8.8
  • TI-2021-17756 Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences