CVE-2021-40855 Security feature bypass in n/a
Attackers can bypass certificate governance by using non-production public keys in production environments, undermining trust in Digital COVID Certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40855?
CVE-2021-40855 is a critical vulnerability in n/a, published on 21 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have been used in production.
Weakness: CWE-295
Which versions are affected by CVE-2021-40855?
It affects 1 product.
Products include Europa Technical Specifications for Digital Covid Certificates.
How do I fix CVE-2021-40855?
No fix has been published for CVE-2021-40855 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-40855 being exploited?
There is no known exploitation of CVE-2021-40855 in the wild and no public exploit code.