1 Resposta
- Mais recentes
- Mais votos
- Mais comentários
2
Hello,
Greengrass is not affected by this CVE.
This CVE concerns SnakeYaml’s Constructor() class does not restrict types which can be instantiated during deserialization
. Greengrass does not use SnakeYaml directly. We import an old version of Jackson dataformat library, which uses SnakeYaml. Jackson is also not affected by this CVE. https://github.com/FasterXML/jackson-dataformats-text/issues/392
We will update Jackson library in our next Nucleus release.
respondido há 9 meses
Conteúdo relevante
- AWS OFICIALAtualizada há um ano
- AWS OFICIALAtualizada há 2 meses