npm/aws-iot-device-sdk-v2 CVE-2021-40828: medium 6.3, EPSS 0.41%

Improper certificate management in AWS IoT Device SDK v2

Action: Upgrade aws-iot-device-sdk-v2 to 1.5.1 or later.

npm i aws-iot-device-sdk-v2@1.5.1

Affected

Fixed versions

Sources

• osv: GHSA-94jq-q5v2-76wj
• https://nvd.nist.gov/vuln/detail/CVE-2021-40828
• https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2
• https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d
• https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be
• https://github.com/advisories/GHSA-94jq-q5v2-76wj
• https://github.com/aws/aws-iot-device-sdk-cpp-v2
• https://github.com/aws/aws-iot-device-sdk-java-v2
• https://github.com/aws/aws-iot-device-sdk-js-v2
• https://github.com/aws/aws-iot-device-sdk-python-v2
• https://github.com/awslabs/aws-c-io
• https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml

CVE-2021-40828 · published 2021-11-24T21:02:24Z · modified 2024-09-12T21:32:15.153100Z · JSON