Miembros de
Boletines de Vulnerabilidades |
Issue with DynamoDB local - CVE-2022-1471 |
|
| Software afectado | AmazonWS |
|
Publication Date: 2024/12/11 2:00PM PST AWS is aware of CVE-2022-1471 in SnakeYaml software, included in DynamoDB local jar and Docker distributions from version 1.21 and version 2.0. If leveraged, this issue could allow an actor to perform remote code execution using the SnakeYamls Constructor(), as the software does not restrict the types that can be instantiated during deserialization. AWS has found no evidence that this issue has been leveraged, however, customers should still take action. More info: https://aws.amazon.com/security/security-bulletins/AWS-2024-014/ |
|
