CVE-2022-41828

In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 GitHub

7.1 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L

EPSS

1.92% chance of exploitation in the next 30 days, 80th percentile

Published

2022-09-29

Updated

2025-05-20

Proof-of-concept exploits (1)

• murataydemir/CVE-2022-418284★ · 2023-06-09

Security advisories

• aws/amazon-redshift-jdbc-driver/commit/40b143b4698faf90c788ffa89f2d4d8d2ad068b5
• aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-jc69-hjw2-fm86
• advisories/GHSA-jc69-hjw2-fm86

References

• CVE Record
• NVD entry

Related

• CVE-2016-2386
• CVE-2016-4014
• CVE-2017-9822
• CVE-2019-18935
• CVE-2020-0688
• CVE-2020-1472