1 回答
- 最新
- 投票最多
- 评论最多
2
Hello,
Greengrass is not affected by this CVE.
This CVE concerns SnakeYaml’s Constructor() class does not restrict types which can be instantiated during deserialization
. Greengrass does not use SnakeYaml directly. We import an old version of Jackson dataformat library, which uses SnakeYaml. Jackson is also not affected by this CVE. https://github.com/FasterXML/jackson-dataformats-text/issues/392
We will update Jackson library in our next Nucleus release.
已回答 9 个月前
相关内容
- AWS 官方已更新 1 年前
- AWS 官方已更新 2 年前