CVE-2021-40830: Improper certificate management in AWS IoT Device SDK v2
Summary
CVE-2021-40830: Improper certificate management in AWS IoT Device SDK v2. Affects software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Also tracked for
- awsiotsdk · PyPI
The same CVE-2021-40830 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS IoT Device SDK v2 is a collection of software development kits (SDKs) that enable developers to build IoT applications that connect to the AWS IoT Core service. The SDKs are available for Java, Python, C++, and Node.js. They provide a set of APIs and tools for device authentication, secure communication, and data exchange with the AWS IoT Core service. The SDKs allow developers to create IoT devices that can securely connect to and interact with the AWS cloud infrastructure.
Vulnerability Detail
The AWS IoT Device SDK v2 for Java, Python, C++, and Node.js has an improper certificate management vulnerability. On Unix systems, the SDK appends a user-supplied Certificate Authority (CA) to the root CAs instead of overriding it. This means that TLS handshakes can succeed if the peer can be verified either from the user-supplied CA or the system's default trust-store. Attackers who have access to a host's trust stores or can compromise a certificate authority already in the host's trust store can exploit this vulnerability to bypass CA pinning. By spoofing the MQTT broker, the attacker can drop traffic, respond with their own data, but cannot forward this data to the MQTT broker without the user's private keys for authentication. The issue has been addressed by updating the 'aws_tls_ctx_options_override_default_trust_store_*' function in the aws-c-io submodule to override the default trust store.
How To Fix
Minimum fixed version
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of the AWS IoT Device SDK v2 as mentioned in the 'how_to_fix' section.
Conclusion
The improper certificate management vulnerability in the AWS IoT Device SDK v2 can be mitigated by updating to the fixed versions of the SDK. It is recommended to always use the latest version of the SDK to ensure the latest security patches and improvements are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk →
FAQ
The AWS IoT Device SDK v2 is a collection of software development kits (SDKs) that enable developers to build IoT applications that connect to the AWS IoT Core service.
The AWS IoT Device SDK v2 supports Java, Python, C++, and Node.js.
CA pinning is a security mechanism that ensures the client only trusts a specific set of certificate authorities (CAs) for establishing secure connections.
No, this vulnerability requires attackers to have access to a host's trust stores or the ability to compromise a certificate authority already in the host's trust store.
There is no known exploit of this vulnerability at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk.
