Amazon Redshift JDBC driver unsafe reflection allows arbitrary code execution
Apps using this database connector can be made to run attacker programs.
Summary
A flaw in how the Amazon Redshift JDBC Driver handles connection parameters and credentials profiles lets an attacker who can influence the connection URL or AWS profile run arbitrary code in the application. Versions before 2.3.0 are affected.
Affected when
- A suitable class is available on the application classpath
- An attacker can influence the JDBC connection URL or AWS credentials profile
What to do
Update to version 2.3.0 or later. If you cannot update immediately, do not build the connection URL or AWS credentials profile from untrusted input, and validate values against an allowlist.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · aws.amazon.com (opens in a new tab)
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen