Read the docs
TI-2021-17756 Aliases CVE-2021-40831GHSA-j3f7-7rmc-6wqj

Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices

Priority LOW 33CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.

Why it matters now

EPSS 0.00636 50th percentileScored 2026-11-07
Fix Fixed AWS IoT Device SDK v2 for Java (Amazon Web Services): 1.5.0AWS IoT Device SDK v2 for Python (Amazon Web Services): 1.7.0+5 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSAWS IoT Device SDK v2 for Javabefore 1.5.01.5.0Patch availableCNA
AWSAWS IoT Device SDK v2 for Pythonbefore 1.7.01.7.0Patch availableCNA
AWSAWS IoT Device SDK v2 for C++before 1.14.01.14.0Patch availableCNA
AWSAWS IoT Device SDK v2 for Node.jsbefore 1.6.01.6.0Patch availableCNA
AWSAWS-C-IO0.10.7—No fix listedCNA
—software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven)before 1.5.01.5.0Patch availableGHSA-j3f7-7rmc-6wqj
—aws-iot-device-sdk-v2 (npm)before 1.6.01.6.0Patch availableGHSA-j3f7-7rmc-6wqj
—awsiotsdk (PyPI)before 1.7.01.7.0Patch availableGHSA-j3f7-7rmc-6wqj
  • AWS IoT Device SDK v2 for Java VendorAWS Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
  • AWS IoT Device SDK v2 for Python VendorAWS Affected before 1.7.0 Fixed in 1.7.0 Patch available CNA
  • AWS IoT Device SDK v2 for C++ VendorAWS Affected before 1.14.0 Fixed in 1.14.0 Patch available CNA
  • AWS IoT Device SDK v2 for Node.js VendorAWS Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA
  • AWS-C-IO VendorAWS Affected 0.10.7 Fixed in — No fix listed CNA
  • software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-j3f7-7rmc-6wqj
  • aws-iot-device-sdk-v2 (npm) Vendor— Affected before 1.6.0 Fixed in 1.6.0 Patch available GHSA-j3f7-7rmc-6wqj
  • awsiotsdk (PyPI) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-j3f7-7rmc-6wqj

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:amazon:amazon_web_services_aws-c-io:0.10.7:*:*:*:*:*:*:*0.10.7VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:*before 1.5.0VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:*before 1.6.0VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:*before 1.7.0VulnerableAWS
cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:*before 1.14.0VulnerableAWS
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:a:amazon:amazon_web_services_aws-c-io:0.10.7:*:*:*:*:*:*:* Versions 0.10.7 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:java:*:* Versions before 1.5.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:node.js:*:* Versions before 1.6.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:python:*:* Versions before 1.7.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:amazon_web_services_internet_of_things_device_software_development_kit_v2:*:*:*:*:*:c\+\+:*:* Versions before 1.14.0 Vulnerable ·AWS
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

  • Fix · CNA AWS IoT Device SDK v2 for Java (Amazon Web Services) Fixed in 1.5.0
  • Fix · CNA AWS IoT Device SDK v2 for Python (Amazon Web Services) Fixed in 1.7.0
  • Fix · CNA AWS IoT Device SDK v2 for C++ (Amazon Web Services) Fixed in 1.14.0
  • Fix · CNA AWS IoT Device SDK v2 for Node.js (Amazon Web Services) Fixed in 1.6.0
  • Fix · GHSA-j3f7-7rmc-6wqj software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven) Fixed in 1.5.0 Advisory →
  • Fix · GHSA-j3f7-7rmc-6wqj aws-iot-device-sdk-v2 (npm) Fixed in 1.6.0 Advisory →
  • Fix · GHSA-j3f7-7rmc-6wqj awsiotsdk (PyPI) Fixed in 1.7.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Amazon Web Services AWS IoT Device SDK v2 for Java 1.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40831
  2. 2026-10-03 Alias added: GHSA-j3f7-7rmc-6wqj
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 10

  • TI-2021-17755 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems CVSS 3.1HIGH 8.8
  • TI-2021-17753 TLS hostname validation issues within AWS IoT Device SDKs on Windows CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences