Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-12745

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.

Published

2024-12-24T17:15:08.150

Last Modified

2025-12-11T18:32:13.417

Status

Analyzed

Source

ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity

CVSSv3.1: 8.0 (HIGH)

Weaknesses

Type: Secondary
CWE-89

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	amazon	redshift_connector	2.1.4	Yes

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-015/ Vendor Advisory (ff89ba41-3aa1-4d27-914a-91399e9639e5)
https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.5 Release Notes (ff89ba41-3aa1-4d27-914a-91399e9639e5)
https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-8gc2-vq6m-rwjw Mitigation, Vendor Advisory (ff89ba41-3aa1-4d27-914a-91399e9639e5)