CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43811 – Code injection via unsafe YAML loading
https://notcve.org/view.php?id=CVE-2021-43811
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. • https://github.com/s-index/CVE-2021-43811 https://github.com/awslabs/sockeye/pull/964 https://github.com/awslabs/sockeye/releases/tag/2.3.24 https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43638
https://notcve.org/view.php?id=CVE-2021-43638
Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet. Amazon Amazon WorkSpaces agent está afectado por un Desbordamiento de Enteros. IOCTL Handler 0x22001B en el agente de Amazon WorkSpaces versiones anteriores a v1.0.1.1537, permite a atacantes locales ejecutar código arbitrario en modo kernel o causar una denegación de servicio (corrupción de memoria y bloqueo del Sistema Operativo) por medio de un paquete de petición de E/S especialmente diseñado • https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43637
https://notcve.org/view.php?id=CVE-2021-43637
Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet. Amazon Amazon WorkSpaces agent está afectado por un Desbordamiento del Búfer. IOCTL Handler 0x22001B en el agente de Amazon WorkSpaces versiones anteriores a v1.0.1.1537, permite a atacantes locales ejecutar código arbitrario en modo kernel o causar una denegación de servicio (corrupción de memoria y bloqueo del Sistema Operativo) por medio de un paquete de petición de E/S especialmente diseñado • https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2021-40831 – Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices
https://notcve.org/view.php?id=CVE-2021-40831
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. • https://github.com/aws/aws-iot-device-sdk-cpp-v2 https://github.com/aws/aws-iot-device-sdk-java-v2 https://github.com/aws/aws-iot-device-sdk-js-v2 https://github.com/aws/aws-iot-device-sdk-python-v2 https://github.com/awslabs/aws-c-io • CWE-295: Improper Certificate Validation •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-40830 – Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems
https://notcve.org/view.php?id=CVE-2021-40830
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. • https://github.com/aws/aws-iot-device-sdk-cpp-v2 https://github.com/aws/aws-iot-device-sdk-java-v2 https://github.com/aws/aws-iot-device-sdk-js-v2 https://github.com/aws/aws-iot-device-sdk-python-v2 https://github.com/awslabs/aws-c-io • CWE-295: Improper Certificate Validation •