USN-7169-3: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Ext4 file system; - Network traffic control; - VMware vSockets driver; CVE-2024-49967, CVE-2024-53057, CVE-2024-502...

The vulnerabilities of the SQLTables() and SQLColumns() functions in the Amazon Redshift ODBC Cloud Database integration software interface allow attackers to exploit these functions to gain increased privileges.

The vulnerability of the SQLTables and SQLColumns functions in the Amazon Redshift ODBC cloud database integration software interface is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

SQL Injection

com.amazon.redshift:redshift-jdbc42 is vulnerable to SQL Injection. The vulnerability is due to insufficient input validation in the getSchemas, getTables, or getColumns Metadata APIs, allowing an attacker to gain escalated privileges...

GHSA-8GC2-VQ6M-RWJW Amazon Redshift Python Connector vulnerable to SQL Injection

Summary A SQL injection in the Amazon Redshift Python Connector in version 2.1.4 allows a user to gain escalated privileges via schema injection in the getschemas, gettables, or getcolumns Metadata APIs. Users should upgrade to the driver version 2.1.5 or revert to driver version 2.1.3. Impact A...

Amazon Redshift Python Connector vulnerable to SQL Injection

Summary A SQL injection in the Amazon Redshift Python Connector in version 2.1.4 allows a user to gain escalated privileges via schema injection in the getschemas, gettables, or getcolumns Metadata APIs. Users should upgrade to the driver version 2.1.5 or revert to driver version 2.1.3. Impact A...

Amazon Redshift JDBC Driver vulnerable to SQL Injection

Summary A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via schema injection in the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30. Impact A SQL...

U.S. Dept Of Defense: Secret Access Key of AWS Firehose Disclosure

The domain had an endpoint that contained the secret access key of an AWS Firehose delivery stream encoded in base64. The secret access key was disclosed, allowing the record to be put into the Firehose delivery stream...

The vulnerability of the AWS S3 platform’s module for developer portals allows attackers to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the AWS S3 platform’s module for developer portals developed by Backstage relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to...

CVE-2024-12745

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the getschemas, gettables, or getcolumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3...

CVE-2024-12746

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 Windows or Linux allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0...

CVE-2024-12744

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30...

CVE-2024-12746

Summary: CVE-2024-12746 concerns the Amazon Redshift ODBC Driver (v2.1.5.0) for Windows/Linux, where a SQL injection via the SQLTables or SQLColumns Metadata APIs can let a user escalate privileges. The issue is confirmed in multiple sources attached to the CVE, with recommended mitigation: upgra...

CVE-2024-12746 SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 Windows or Linux allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0...

CVE-2024-12746 SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 Windows or Linux allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0...

CVE-2024-12745 SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the getschemas, gettables, or getcolumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3...

CVE-2024-12745

Summary: CVE-2024-12745 affects the Amazon Redshift Python Connector (version 2.1.4). The vulnerability is a SQL injection occurring through the metadata APIs get_schemas, get_tables, and get_columns, potentially enabling elevated privileges. Impact and remediation: Upgrade to driver version 2.1....

CVE-2024-12745 SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the getschemas, gettables, or getcolumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3...

CVE-2024-12744 SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30...

CVE-2024-12744 SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30...

CVE-2024-12744

CVE-2024-12744 affects the Amazon Redshift JDBC Driver v2.1.0.31, where a SQL injection via the getSchemas, getTables, or getColumns metadata APIs can grant escalated privileges. The issue is fixed in driver v2.1.0.32; guidance is to upgrade to 2.1.0.32 or revert to 2.1.0.30. Exploitation details...