This vulnerability (CWE-470) involves the use of externally-controlled input to select classes or code in the Amazon Redshift JDBC Driver. Specifically, the driver versions before 2.2.2 may load and execute arbitrary classes based on manipulated JDBC connection URL parameters. An attacker able to control the connection URL could exploit this to execute code in the application context, contingent on the presence of appropriate classes on the classpath. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity. The vendor advisory from AWS recommends upgrading to version 2.2.2 or later to address the issue.

Successful exploitation allows an attacker who can influence the JDBC connection URL to execute arbitrary code within the application context. This can lead to full compromise of the application using the vulnerable driver, impacting confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Users should upgrade the Amazon Redshift JDBC Driver to version 2.2.2 or later, as recommended by the AWS security advisory. Patch status is confirmed by the vendor advisory. No additional mitigations are specified or required once the upgrade is applied.