| Package | Affected versions | Patched versions |
|---|---|---|
| com.amazon.redshift:redshift-jdbc42 | < 2.1.0.8 | 2.1.0.8 |
| amazon web services redshift java database connectivity driver | < 2.1.0.8 | 2.1.0.8 |
A potential remote command execution issue exists within redshift-jdbc42 versions 2.1.0.7 and below. When plugins are used with the driver, it instantiates plugin instances based on Java class names provided via the sslhostnameverifier, socketFactory, sslfactory, and sslpasswordcallback connection properties. In affected versions, the driver does not verify if a plugin class implements the expected interface before instantiatiaton. This can lead to loading of arbitrary Java classes, which a knowledgeable attacker with control over the JDBC URL can use to achieve remote code execution.
This issue is patched within redshift-jdbc-42 2.1.0.8 and above.
We advise customers using plugins to upgrade to redshift-jdbc42 version 2.1.0.8 or above. There are no known workarounds for this issue.
If you have any questions or comments about this advisory, please contact AWS Security at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free