3 ms·
I've said it before and I'll say it again: ghostscript will never be safe, ever. If you must run it then make it 100% isolated, for instance in a lambda with n
by arkadiyt 3y ago
I've said it before and I'll say it again: ghostscript will never be safe, ever.
If you must run it then make it 100% isolated, for instance in a lambda with no api credentials or IAM permissions, & do s3 input/output by passing presigned urls. Make it ok to have RCE.
- cjbprime 3y agoAnd make sure never to re-use one lambda function or container to process more than a single customer's data, to avoid the RCE gaining access to whatever file next gets uploaded :)