CVE-2021-40829: AWS IoT Device SDK v2 for Python Insecure Certificate Verification on macOS
Summary
CVE-2021-40829: Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certif... Affects awsiotsdk versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
The same CVE-2021-40829 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS IoT Device SDK v2 for Python is a software development kit that provides libraries and tools for developers to build applications that connect to the AWS IoT Core service. It allows devices to securely communicate with the AWS IoT Core using the MQTT or HTTP protocols. The SDK supports various features such as device shadow, jobs, and device provisioning. However, versions prior to 1.6.1 on macOS are vulnerable to an insecure certificate verification issue.
Vulnerability Detail
The vulnerability in the AWS IoT Device SDK v2 for Python on macOS arises from a failure to verify the server certificate hostname during the TLS handshake when overriding Certificate Authorities (CA) in the trust stores. This means that an attacker could potentially perform a man-in-the-middle attack by presenting a rogue certificate with a different hostname, leading to unauthorized access or data interception. The issue has been addressed in version 1.6.1 of the SDK.
How To Fix
Minimum fixed version
1.6.1
This is the first release that contains the fix.
pip install --upgrade "awsiotsdk==1.6.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the SDK to the fixed version as soon as possible.
Conclusion
The AWS IoT Device SDK v2 for Python on macOS is vulnerable to an insecure certificate verification issue. It is crucial to update to version 1.6.1 or later to mitigate the risk of unauthorized access or data interception. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for awsiotsdk →
FAQ
This vulnerability could allow an attacker to intercept or manipulate the communication between the device and the AWS IoT Core, potentially leading to unauthorized access or data leakage.
Versions prior to 1.6.1 on macOS are affected by this vulnerability.
This vulnerability specifically affects the AWS IoT Device SDK v2 for Python on macOS. However, similar issues have been identified in the AWS IoT Device SDK v2 for Java, C++, and Node.js on macOS.
There is no known evidence of this vulnerability being actively exploited in the wild at the time of this advisory.
You can find more information about this vulnerability in the AWS IoT Device SDK v2 for Python advisory PYSEC-2021-862.
References
Related vulnerabilities
Recent vulnerabilities recorded for awsiotsdk.
