PT-2024-10194 · Amazon · Amazon Redshift Python Connector

Published 2024-12-18 · Updated 2025-12-11 · CVE-2024-12745

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Amazon Redshift Python Connector version 2.1.4

Description A SQL injection in the Amazon Redshift Python Connector allows a user to gain escalated privileges via the get schemas, get tables, or get columns Metadata APIs.

Recommendations For Amazon Redshift Python Connector version 2.1.4, upgrade to the driver version 2.1.5 or revert to driver version 2.1.3. As a temporary workaround, consider restricting access to the get schemas, get tables, and get columns Metadata APIs until a patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-00523

CVE-2024-12745

GHSA-8GC2-VQ6M-RWJW

Affected Products

Amazon Redshift Python Connector

References · 25

• https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-8gc2-vq6m-rwjw · Vendor Advisory
• https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.5 · Patch
• https://osv.dev/vulnerability/GHSA-8gc2-vq6m-rwjw · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00523 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-12745 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12745 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2024-015 · Vendor Advisory
• https://github.com/aws/amazon-redshift-python-driver · Note
• https://twitter.com/the_yellow_fall/status/1872094981756010596 · Twitter Post
• https://twitter.com/happygeek/status/1872238350322761863 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1871613367871226245 · Twitter Post
• https://twitter.com/cybertzar/status/1872220700942975313 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1872208338768871507 · Twitter Post
• https://twitter.com/TMJIntel/status/1872257806587318550 · Twitter Post
• https://twitter.com/CVEnew/status/1871599299777425452 · Twitter Post