Amazon Ion-C Uninitialized Stack Read Vulnerability Allowing Memory Disclosure

A vulnerability exists in Amazon Ion-C versions prior to 1.1.4, where an uninitialized stack read could lead to the exposure of sensitive data in memory. This issue allows a threat actor to craft data and serialize it to Ion text, potentially revealing private information through UTF-8 escape sequences.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive memory data.

Remediation

Users are advised to upgrade to Amazon Ion-C version 1.1.4. It is also recommended to only accept data from trusted sources that have been written using a supported Ion library.