PatchTheCVECVE-2021-40829: Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prio
CVE-2021-40829 is a medium-severity flaw (CVSS 6.3) affecting amazon web services internet of things device software development kit v2, amazon web services internet of things device software development kit v2, amazon web services internet of things device software development kit v2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services A
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2021-11-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-40829?
amazon web services internet of things device software development kit v2: upgrade to 1.4.2; amazon web services internet of things device software development kit v2: upgrade to 1.5.3; amazon web services internet of things device software development kit v2: upgrade to 1.6.1. Exact commands for each OS are on this page.
Is CVE-2021-40829 being exploited?
CVE-2021-40829 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-40829 affect?
CVE-2021-40829 affects amazon web services internet of things device software development kit v2, amazon web services internet of things device software development kit v2, amazon web services internet of things device software development kit v2. Severity is medium (CVSS 6.3). Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname durin
How urgent is CVE-2021-40829?
Priority 35/100. On your watchlist
Software pages
Node.js vulnerabilities · Python vulnerabilities · Java vulnerabilities · macOS vulnerabilities · AWS vulnerabilities
Related CVEs
- CVE-2021-40831 MEDIUM 6.3 DOWNGRADE UPGRADE The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA)
- CVE-2021-40830 MEDIUM 6.3 DOWNGRADE UPGRADE The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA)
- CVE-2021-40828 MEDIUM 6.3 UPGRADE UPGRADE Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prio