Bug description
The DCV Session Manager broker installed on RES broker hosts includes Apache Ignite < 2.17.0, which is affected by CVE-2024-52577, a pre-authentication remote code execution vulnerability via unsafe Java deserialization. An attacker with network access to the broker could execute arbitrary code on the broker host.
Affected versions
2025.06 - 2026.03
Mitigation
The fix is delivered via the upstream DCV Session Manager broker package (version 2025.0.561), which upgrades Apache Ignite to 2.18.0. RES environments pull the latest broker RPM from CloudFront using unversioned URLs, so the fix is automatically picked up when a new broker host is launched.
To apply the fix, cycle the current DCV broker instance and let the Auto Scaling Group launch a new one with the patched broker package. We strongly recommend running these CLI commands in AWS CloudShell — a free, browser-based shell pre-authenticated with your console credentials.
- Configure the AWS CLI for the account/region where RES is deployed.
- Terminate the current broker instance:
ENVIRONMENT_NAME=<environment-name>
INSTANCE_ID=$(aws ec2 describe-instances \
--filters \
Name=tag:Name,Values=${ENVIRONMENT_NAME}-vdc-broker \
Name=tag:res:EnvironmentName,Values=${ENVIRONMENT_NAME} \
--query "Reservations[0].Instances[0].InstanceId" \
--output text)
aws ec2 terminate-instances --instance-ids ${INSTANCE_ID}
- The Auto Scaling Group will automatically launch a new broker instance with the latest DCV Session Manager broker package containing the fix.
- Verify the new DCV Broker instance is healthy by checking that its associated target groups show a healthy status in the Amazon EC2 console under Load Balancing > Target Groups. Look for target groups containing
<environment-name>-broker in the name for your environment.
- Connect to the new broker instance and verify the broker version is
2025.0.561 or higher:
rpm -q nice-dcv-session-manager-broker
# Expected output: nice-dcv-session-manager-broker-2025.0.561-1.amzn2023.noarch (or higher)
Rollback
No rollback is needed. The fix is a standard upstream package upgrade of the DCV Session Manager broker. The new broker instance will always pull the latest available version from CloudFront. Rolling back would require pinning an older broker version, which is not recommended as it would reintroduce the vulnerability.
Bug description
The DCV Session Manager broker installed on RES broker hosts includes Apache Ignite < 2.17.0, which is affected by CVE-2024-52577, a pre-authentication remote code execution vulnerability via unsafe Java deserialization. An attacker with network access to the broker could execute arbitrary code on the broker host.
Affected versions
2025.06 - 2026.03
Mitigation
The fix is delivered via the upstream DCV Session Manager broker package (version 2025.0.561), which upgrades Apache Ignite to 2.18.0. RES environments pull the latest broker RPM from CloudFront using unversioned URLs, so the fix is automatically picked up when a new broker host is launched.
To apply the fix, cycle the current DCV broker instance and let the Auto Scaling Group launch a new one with the patched broker package. We strongly recommend running these CLI commands in AWS CloudShell — a free, browser-based shell pre-authenticated with your console credentials.
<environment-name>-brokerin the name for your environment.2025.0.561or higher:Rollback
No rollback is needed. The fix is a standard upstream package upgrade of the DCV Session Manager broker. The new broker instance will always pull the latest available version from CloudFront. Rolling back would require pinning an older broker version, which is not recommended as it would reintroduce the vulnerability.