Awsiotpythonsdk
Monthly
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 through 1.6.0 running on Python 3.7 and later allows an adversary-in-the-middle who possesses a certificate issued for an unrelated hostname by a certificate authority already in the device trust store to impersonate the AWS IoT Core endpoint, read device telemetry, and inject MQTT messages that the device processes as authentic. This is not exploitable from an arbitrary internet location: the attacker must hold an on-path position and a trusted-CA certificate for an unrelated hostname. No public exploit was identified at time of analysis, and the vendor has released 1.6.1 to enforce hostname verification.
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 through 1.6.0 running on Python 3.7 and later allows an adversary-in-the-middle who possesses a certificate issued for an unrelated hostname by a certificate authority already in the device trust store to impersonate the AWS IoT Core endpoint, read device telemetry, and inject MQTT messages that the device processes as authentic. This is not exploitable from an arbitrary internet location: the attacker must hold an on-path position and a trusted-CA certificate for an unrelated hostname. No public exploit was identified at time of analysis, and the vendor has released 1.6.1 to enforce hostname verification.