Closed soorajantonyofficial closed 5 months ago
@Team, can you please let us know on this issue?
I'm sorry for the delay, there's a new version available now, that uses Go 1.20.14 https://github.com/aws/aws-lambda-runtime-interface-emulator/releases/tag/v1.16
Issue Highlight:
Go package stdlib is vulnerable to CVE-2023-45285. Severity of exposure for this CVE is marked high as per NIST and MITRE.
The CVE is described as
Recommendation:
Since the latest AWS Lambda RIE utilizes stdlib, a patch to upgrade Go binary from 1.20.11 to go1.20.12 or go1.21.5 (or newer) would be an ideal solution to resolve this CVE exposure.