PT-2024-24941 · Amazon · Amazon Redshift Jdbc Driver

Paul-Gerste-Sonarsource · Published 2024-02-21 · Updated 2025-06-12 · CVE-2024-32888

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon Redshift JDBC Driver versions prior to 2.1.0.28

Description The issue allows for SQL injection when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. The preferQueryMode property is not a supported parameter in the Redshift JDBC driver and is inherited code from the Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected.

Recommendations For Amazon Redshift JDBC Driver versions prior to 2.1.0.28, do not use the connection property preferQueryMode=simple to mitigate the issue. Upgrade to version 2.1.0.28 or later to patch the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-32888

GHSA-24RP-Q3W6-VC56

GHSA-X3WM-HFFR-CHWM

Affected Products

Amazon Redshift Jdbc Driver

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32888.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32888 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-1597 · Security Note
• https://osv.dev/vulnerability/GHSA-x3wm-hffr-chwm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32888 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-24rp-q3w6-vc56 · Vendor Advisory
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 · Note
• https://github.com/pgjdbc/pgjdbc · Note
• https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee · Note
• https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40 · Note
• https://github.com/aws/amazon-redshift-jdbc-driver · Note
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/12a5e8ecfbb44c8154fc66041cca2e20ecd7b339 · Note
• https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-x3wm-hffr-chwm · Note
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/0d354a5f26ca23f7cac4e800e3b8734220230319 · Note
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/bc93694201a291493778ce5369a72befeca5ba7d · Note