GHSA-8wj8-cfxr-9374
GHSA-8wj8-cfxr-9374 · AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance
This page contains facts from public vulnerability sources. Check the original advisory before updating.
### Description of Vulnerability: An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. AWS recommends that customers upgrade to the following version: AWS NodeJS Wrapper to v2.0.1. ### Source of Vulnerability Report: Allistair Ishmael Hakim [[email protected]](mailto:[email protected]) ### Affected products & versions: AWS NodeJS Wrapper < 2.0.1. ### Platforms: MacOS/Windows/Linux
CVSS 8.0 · High · Fix available
- Published
- Updated
Stack: node
Affected products and versions
aws-advanced-nodejs-wrapper npm
- Affected ranges
- SEMVER: < 2.0.1
Update to 2.0.1
Original sources
- https://github.com/aws/aws-advanced-nodejs-wrapper/security/advisories/GHSA-8wj8-cfxr-9374
- https://github.com/aws/aws-advanced-nodejs-wrapper/pull/574
- https://github.com/aws/aws-advanced-nodejs-wrapper
- https://github.com/aws/aws-advanced-nodejs-wrapper/releases/tag/2.0.1
- https://osv.dev/vulnerability/GHSA-8wj8-cfxr-9374