1 個回答
- 最新
- 最多得票
- 最多評論
2
Hello,
Greengrass is not affected by this CVE.
This CVE concerns SnakeYaml’s Constructor() class does not restrict types which can be instantiated during deserialization
. Greengrass does not use SnakeYaml directly. We import an old version of Jackson dataformat library, which uses SnakeYaml. Jackson is also not affected by this CVE. https://github.com/FasterXML/jackson-dataformats-text/issues/392
We will update Jackson library in our next Nucleus release.
已回答 9 個月前
相關內容
- 已提問 6 個月前
- AWS 官方已更新 1 年前
- AWS 官方已更新 1 年前
- AWS 官方已更新 2 年前