VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Nov 22, 2021· Updated Aug 4, 2024

TLS hostname validation issues within AWS IoT Device SDKs on Windows

CVE-2021-40828

Description

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdkMaven
< 1.3.31.3.3
aws-iot-device-sdk-v2npm
< 1.5.11.5.1
awsiotsdkPyPI
< 1.5.181.5.18

Affected products

1

Patches

3
fd4c0ba04b35

Update to latest CRT (#208)

https://github.com/aws/aws-iot-device-sdk-python-v2Bret AmbroseJun 3, 2021via ghsa
commit
1 file changed · +1 −1
  • setup.py+1 −1 modified
    @@ -40,7 +40,7 @@ def _load_version():
         "Operating System :: OS Independent",
     ],
     install_requires=[
-        'awscrt==0.11.20',
+        'awscrt==0.11.22',
     ],
     python_requires='>=3.6',
 )
67950ad2a02f

Windows SNI with CA Override (#164)

https://github.com/aws/aws-iot-device-sdk-java-v2Bret AmbroseMay 28, 2021via ghsa
commit
1 file changed · +1 −1
  • sdk/pom.xml+1 −1 modified
    @@ -42,7 +42,7 @@
     <dependency>
       <groupId>software.amazon.awssdk.crt</groupId>
       <artifactId>aws-crt</artifactId>
-      <version>0.12.6</version>
+      <version>0.12.8</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
4be41394f1ae

Update CRT version to pull in multiple fixes (#159)

https://github.com/aws/aws-iot-device-sdk-js-v2Bret AmbroseMay 28, 2021via ghsa
commit
2 files changed · +8 −8
  • package.json+1 −1 modified
    @@ -30,6 +30,6 @@
     "typescript": "^3.9.7"
   },
   "dependencies": {
-    "aws-crt": "1.7.0"
+    "aws-crt": "1.7.1"
   }
 }
  • package-lock.json+7 −7 modified
    @@ -9,7 +9,7 @@
       "version": "1.0.0-dev",
       "license": "Apache-2.0",
       "dependencies": {
-        "aws-crt": "1.7.0"
+        "aws-crt": "1.7.1"
       },
       "devDependencies": {
         "@convergencelabs/typedoc-plugin-custom-modules": "^0.4.0",
@@ -118,9 +118,9 @@
       "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k="
     },
     "node_modules/aws-crt": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/aws-crt/-/aws-crt-1.7.0.tgz",
-      "integrity": "sha512-cM+APBG22hzu3a61B6KhumON1j/CK5JwoDk56HOFlCTi47MVliX20H+NEWdogM2QSpsyZSr0J2MSL9hJpH1AJw==",
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/aws-crt/-/aws-crt-1.7.1.tgz",
+      "integrity": "sha512-PByLy6ljPr4zwxQN16h2Nb62PhUCcjqg+kvpLn94iYmJekm8W6dk5pCVc0QCE7+VNMFIbaexZOymFugvMvbKzg==",
       "hasInstallScript": true,
       "dependencies": {
         "axios": "^0.21.1",
@@ -2239,9 +2239,9 @@
       "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k="
     },
     "aws-crt": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/aws-crt/-/aws-crt-1.7.0.tgz",
-      "integrity": "sha512-cM+APBG22hzu3a61B6KhumON1j/CK5JwoDk56HOFlCTi47MVliX20H+NEWdogM2QSpsyZSr0J2MSL9hJpH1AJw==",
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/aws-crt/-/aws-crt-1.7.1.tgz",
+      "integrity": "sha512-PByLy6ljPr4zwxQN16h2Nb62PhUCcjqg+kvpLn94iYmJekm8W6dk5pCVc0QCE7+VNMFIbaexZOymFugvMvbKzg==",
       "requires": {
         "axios": "^0.21.1",
         "cmake-js": "^6.1.0",

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.