CVE-2022-41828: Incorrect Type Conversion or Cast (CWE-704)
value: In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 8.1
Published: 2022-09-29T21:15Z
Repository: https://github.com/aws/amazon-redshift-jdbc-driver
Language: Markdown
Files changed: CHANGELOG.md, README.md, pom.xml
Commit date: 2022-06-09 02:20:19 +0000
Commit message: Release of 2.1.0.8 version

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c0238d..affe4ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,16 @@
 Changelog
 =========
 
+v2.1.0.8 (2022-06-08)
+------------
+- Fix [issue#54](https://github.com/aws/amazon-redshift-jdbc-driver/issues/54) [ilesh Garish]
+- Fix [issue#53](https://github.com/aws/amazon-redshift-jdbc-driver/issues/53) [ilesh Garish]
+- Fix Object Factory to check class type when instantiating an object
+  from class name. [ilesh Garish]
+- Set default 15 min timeout to protect pops-up for OAuth2 Browser Plugin [ilesh Garish]
+
 v2.1.0.7 (2022-05-04)
 ---------------------
 - Updated SAML Plugin browser launch process. [ilesh Garish]
 - Fix race condition for Browser Plugin. [ilesh Garish]
 
diff --git a/README.md b/README.md
index e6ed058..e872dc0 100644
--- a/README.md
+++ b/README.md
@@ -32,12 +32,12 @@ The jar file is the Redshift JDBC driver.The zip file contains the driver jar fi
 
 See [Amazon Redshift JDBC Driver Installation and Configuration Guide](https://docs.aws.amazon.com/redshift/latest/mgmt/jdbc20-install.html) for more information.
 
 Here are download links for the latest release:
 
-* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.7/redshift-jdbc42-2.1.0.7.zip
-* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.7/redshift-jdbc42-2.1.0.7.jar
+* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.8/redshift-jdbc42-2.1.0.8.zip
+* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.8/redshift-jdbc42-2.1.0.8.jar
 
 It also available on Maven Central, groupId: com.amazon.redshift and artifactId: redshift-jdbc42.
 
 ## Report Bugs
 
diff --git a/pom.xml b/pom.xml
index 51d7193..e560ea5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,11 +4,11 @@
 
     <groupId>com.amazon.redshift</groupId>
     <artifactId>redshift-jdbc42</artifactId>
     <packaging>bundle</packaging>
     <name>Redshift JDBC Driver - JDBC 4.2</name>
-    <version>2.1.0.7</version>
+    <version>2.1.0.8</version>
 
     <description>Java JDBC 4.2 (JRE 8+) driver for Redshift database</description>
 
     <organization>
         <name>Amazon.com Inc.</name>

Vulnerable code: * https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.7/redshift-jdbc42-2.1.0.7.zip
* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.7/redshift-jdbc42-2.1.0.7.jar
    <version>2.1.0.7</version>
Fixed code: v2.1.0.8 (2022-06-08)
------------
- Fix [issue#54](https://github.com/aws/amazon-redshift-jdbc-driver/issues/54) [ilesh Garish]
- Fix [issue#53](https://github.com/aws/amazon-redshift-jdbc-driver/issues/53) [ilesh Garish]
- Fix Object Factory to check class type when instantiating an object
  from class name. [ilesh Garish]
- Set default 15 min timeout to protect pops-up for OAuth2 Browser Plugin [ilesh Garish]

* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.8/redshift-jdbc42-2.1.0.8.zip
* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.8/redshift-jdbc42-2.1.0.8.jar
    <version>2.1.0.8</version>