GHSA-qrph-v96m-w2mv: Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.
To remediate this issue, users should upgrade to version 2.3.0 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon Redshift JDBC Driverto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
What must an attacker be able to control to exploit this issue?
The attacker must be able to influence the JDBC connection URL or the AWS credentials profile. Exploitation also requires that a suitable class be present on the application classpath.
Which applications are exposed?
Applications using an Amazon Redshift JDBC Driver version earlier than 2.3.0 are potentially exposed if untrusted parties can affect connection parameters or AWS credentials profiles. Successful exploitation runs arbitrary code in the application context.
How can I determine whether remediation is needed?
Check the version of the Amazon Redshift JDBC Driver used by the application. Versions before 2.3.0 should be upgraded to version 2.3.0 or later.