Amazon Redshift Jdbc Driver
Monthly
Unsafe class loading (CWE-470) in Amazon Redshift JDBC Driver before 2.3.0 lets an actor who can influence the JDBC connection URL parameters or the AWS credentials profile fields cause the driver to load and instantiate classes present on the application classpath, resulting in code execution inside the application's JVM. The flaw is not reachable against the driver in isolation: it requires an application that constructs connection strings or credentials profiles from externally controllable input, plus a suitable gadget class already available on the classpath, which is why the assessed CVSS 3.1 vector carries AC:H despite PR:N and full confidentiality/integrity/availability impact. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the vendor has released a fix and the priority call is act_now given the RCE outcome.
Remote code execution in Amazon Redshift JDBC Driver versions prior to 2.2.2 allows unauthenticated network attackers to execute arbitrary code by manipulating JDBC connection URL parameters under high-complexity conditions. The driver can be exploited to load and execute arbitrary classes from the application's classpath when specific connection URL parameters are controlled by an attacker. AWS released patch version 2.2.2 with GHSA advisory GHSA-wmmv-vvg5-993q. CVSS 9.2 (Critical) reflects high impact across confidentiality, integrity, and availability, though attack complexity is high and attack vector prerequisites are present.
Unsafe class loading (CWE-470) in Amazon Redshift JDBC Driver before 2.3.0 lets an actor who can influence the JDBC connection URL parameters or the AWS credentials profile fields cause the driver to load and instantiate classes present on the application classpath, resulting in code execution inside the application's JVM. The flaw is not reachable against the driver in isolation: it requires an application that constructs connection strings or credentials profiles from externally controllable input, plus a suitable gadget class already available on the classpath, which is why the assessed CVSS 3.1 vector carries AC:H despite PR:N and full confidentiality/integrity/availability impact. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the vendor has released a fix and the priority call is act_now given the RCE outcome.
Remote code execution in Amazon Redshift JDBC Driver versions prior to 2.2.2 allows unauthenticated network attackers to execute arbitrary code by manipulating JDBC connection URL parameters under high-complexity conditions. The driver can be exploited to load and execute arbitrary classes from the application's classpath when specific connection URL parameters are controlled by an attacker. AWS released patch version 2.2.2 with GHSA advisory GHSA-wmmv-vvg5-993q. CVSS 9.2 (Critical) reflects high impact across confidentiality, integrity, and availability, though attack complexity is high and attack vector prerequisites are present.