Amazon Web Services Aws-C-Io vulnerabilities

3 CVEs affecting Amazon Web Services Aws-C-Io, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-40831, published 2021-11-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40831, published 2021-11-23. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation…
CVE-2021-40828, published 2021-11-23. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did…
CVE-2021-40830, published 2021-11-23. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus…