Vulnerability · Published Dec 24, 2024 · Assigned by AMZN
CVE-2024-12745SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4
High 8.0
In plain English
A high-severity SQL injection in Amazon Redshift Python Connector from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.5%top 55.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | redshift-connector | 2.1.5 | GHSA-8gc2-vq6m-rwjw |
| PyPI | redshift-connector | 2.1.5 | PYSEC-2026-1866 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Amazon Redshift Python Connector | 2.1.4 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H