Security for AWS Lambda Serverless Applications

Serverless computing is another beautiful cloud-based advancement for developers. But, like all applications, proper security is required to maximize the benefits. Learn more in this article...

Imperva® Offers Free Serverless Protection for AWS Lambda

Just as other instant computing infrastructures have done in the past, Function-as-a-Service FaaS now enables DevOps teams to deploy applications more efficiently at a fraction of the cost. AWS Lambda, Amazon Web Services’ AWS serverless approach to infrastructure, enables companies to go-to-mark...

What’s new on AWS Lambda in 2021

This article explores new updates and documentation for AWS Lambda in 2021. Lambda launched several new updates including run container images, cost saving initiatives, and expanded compute capacity...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2019-20916 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

auto-dl (0.1.1), aws-lambda-sls (0.1.0) +53 more potentially affected by CVE-2019-20916 via pip (>=1.5.6, <=19.1.1)

pip PYPI version =1.5.6, =0.0.0, =0.1.17, =1.0.1, =1.5.114, =3.4.13, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =2.4.0, =1.5.6, =1.5.8 and more Source cves: CVE-2019-20916 Source advisory: MEND:CVE-2019-20916...

GHSA-934X-72XH-5HRG OS command injection in aws-lambda

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

@xapp/stentor (>=1.13.9, <=1.15.0) potentially affected by CVE-2019-10777 via aws-lambda (>=1.0.0, <=1.0.4)

aws-lambda NPM version =1.0.0, =1.13.9, =1.15.0 Source cves: CVE-2019-10777 Source advisory: OSV:GHSA-934X-72XH-5HRG...

OS command injection in aws-lambda

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

@xapp/stentor (>=1.13.9, <=1.15.0) potentially affected by CVE-2019-10777 via aws-lambda (>=1.0.0, <=1.0.4)

aws-lambda NPM version =1.0.0, =1.13.9, =1.15.0 Source cves: CVE-2019-10777 Source advisory: GHSA-934X-72XH-5HRG...

Arbitrary Command Injection

aws-lambda is vulnerable to arbitrary command injection. The vulnerability exists due to the lack of sanitization on the value of config.FunctionName, allowing injection payloads to reach the exec function...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

Design/Logic Flaw

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2019-10777

CVE-2019-10777 affects aws-lambda prior to v1.0.5. The vulnerability arises because config.FunctioName is used to assemble the argument for exec without sanitization, enabling an attacker to inject arbitrary commands into the zipCmd executed via config.FunctionName. Impact ranges from partial to ...

@bitcoin-miles/base-service (>=1.0.3, <=1.1.4), @botsbotsbots/api (>=0.1.0-latest.30e51283, <=0.1.0-latest.d90c50ea) +96 more potentially affected by CVE-2019-10777 via aws-lambda (>=0.1.2, <=1.0.4)

aws-lambda NPM version =0.1.2, =1.0.3, =0.1.0-latest.30e51283, =1.0.0, =0.5.0, =0.1.0, =0.0.1, =1.0.0-alpha.30, =1.0.0-alpha.12, =1.2.0-alpha.1, =1.0.0, =0.0.1, =1.7.0, =3.0.0 - @graphcool/lambda-helpers 0.2.2 and more Source cves: CVE-2019-10777 Source advisory: MEND:CVE-2019-10777...

PT-2020-9129

Name of the Vulnerable Software and Affected Versions aws-lambda versions prior to 1.0.5 Description The issue allows a user to inject arbitrary commands into the zipCmd used within the config.FunctionName due to a lack of sanitization of the config.FunctionName when constructing the argument for...

CVE-2019-10777: Improper Neutralization of Special Elements used in an OS Command

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

@xapp/stentor (>=1.13.9, <=1.15.0) potentially affected by CVE-2019-10777 via aws-lambda (>=1.0.0, <=1.0.4)

aws-lambda NPM version =1.0.0, =1.13.9, =1.15.0 Source cves: CVE-2019-10777 Source advisory: SNYK:JS-AWSLAMBDA-540839...

Command Injection

Overview aws-lambda is a command line tool deploy code to AWS Lambda. Affected versions of this package are vulnerable to Command Injection. The config.FunctioName is used to construct the argument used within the exec function without any sanitization. It is possible for a user to inject arbitra...