CVE-2020-28472

Name of the Vulnerable Software and Affected Versions: @aws-sdk/shared-ini-file-loader versions prior to 1.0.0-rc.9 aws-sdk versions prior to 2.814.0

Description: The issue arises when an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles. This can lead to prototype pollution on the application, which can be exploited further depending on the context.

Recommendations: For @aws-sdk/shared-ini-file-loader versions prior to 1.0.0-rc.9, update to version 1.0.0-rc.9 or later. For aws-sdk versions prior to 2.814.0, update to version 2.814.0 or later. As a temporary workaround, consider restricting the use of the loadSharedConfigFiles function until a patch is available.