{"action":"Upgrade software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk to 1.3.3 or later.","affected":[{"fixed":"1.3.3","introduced":"0"}],"component":"software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk","cve_ids":["CVE-2021-40828"],"ecosystem":"Maven","epss":0.00411,"exploited":false,"fixed_versions":["1.3.3"],"ghsa_id":"GHSA-94jq-q5v2-76wj","id":"tcs_01M5N8P3FPQ0M2DFQ8Y3AE3GX5","modified_at":"2024-09-12T21:32:15.153100Z","published_at":"2021-11-24T21:02:24Z","references":["https://osv.dev/vulnerability/GHSA-94jq-q5v2-76wj","https://nvd.nist.gov/vuln/detail/CVE-2021-40828","https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2","https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d","https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be","https://github.com/advisories/GHSA-94jq-q5v2-76wj","https://github.com/aws/aws-iot-device-sdk-cpp-v2","https://github.com/aws/aws-iot-device-sdk-java-v2","https://github.com/aws/aws-iot-device-sdk-js-v2","https://github.com/aws/aws-iot-device-sdk-python-v2","https://github.com/awslabs/aws-c-io","https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-94jq-q5v2-76wj#Maven/software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk","url":"https://osv.dev/vulnerability/GHSA-94jq-q5v2-76wj"}],"summary":"Improper certificate management in AWS IoT Device SDK v2"}