GHSA-R244-WG5G-6W2R Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

Summary Amazon Redshift Python Connector is a pure Python connector to Redshift i.e., driver that implements the Python Database API Specification 2.0. When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certifica...

arrow-pd-parser (>=1.0.0, <=1.0.4), awsdf (>=0.1.1, <=0.1.15) +36 more potentially affected by CVE-2025-5279 via redshift-connector (>=2.0.888, <=2.1.5)

redshift-connector PYPI version =2.0.888, =1.0.0, =0.1.1, =2.0.0, =0.1.17, =1.0.0a1, =0.4.0, =0.0.1, =0.3.64, =6.1.2, =0.5.2, =1.5.0b1, =0.1.0, =0.2.23, =0.0.141, =0.1.2, =0.1.4 and more Source cves: CVE-2025-5279 Source advisory: GHSA-R244-WG5G-6W2R...

arrow-pd-parser (>=1.0.0, <=1.0.4), awsdf (>=0.1.1, <=0.1.15) +36 more potentially affected by CVE-2025-5279 via redshift-connector (>=2.0.888, <=2.1.5)

redshift-connector PYPI version =2.0.888, =1.0.0, =0.1.1, =2.0.0, =0.1.17, =1.0.0a1, =0.4.0, =0.0.1, =0.3.64, =6.1.2, =0.5.2, =1.5.0b1, =0.1.0, =0.2.23, =0.0.141, =0.1.2, =0.1.4 and more Source cves: CVE-2025-5279 Source advisory: OSV:GHSA-R244-WG5G-6W2R...

arrow-pd-parser (>=1.0.0, <=1.0.4), awsdf (>=0.1.1, <=0.1.15) +36 more potentially affected by CVE-2025-5279 via redshift-connector (>=2.0.888, <=2.1.5)

redshift-connector PYPI version =2.0.888, =1.0.0, =0.1.1, =2.0.0, =0.1.17, =1.0.0a1, =0.4.0, =0.0.1, =0.3.64, =6.1.2, =0.5.2, =1.5.0b1, =0.1.0, =0.2.23, =0.0.141, =0.1.2, =0.1.4 and more Source cves: CVE-2025-5279 Source advisory: SNYK:PYTHON-REDSHIFTCONNECTOR-10259369...

Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

Summary Amazon Redshift Python Connector is a pure Python connector to Redshift i.e., driver that implements the Python Database API Specification 2.0. When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certifica...

Improper Certificate Validation

Overview redshift-connector is a Redshift interface library Affected versions of this package are vulnerable to Improper Certificate Validation when using the BrowserAzureOAuth2CredentialsProvider plugin. An attacker can intercept token exchange communication and retrieve an access token by...

CVE-2025-5279

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

CVE-2025-5279

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

arrow-pd-parser (>=1.0.0, <=1.0.4), awsdf (>=0.1.1, <=0.1.15) +36 more potentially affected by CVE-2025-5279 via redshift-connector (>=2.0.888, <=2.1.5)

redshift-connector PYPI version =2.0.888, =1.0.0, =0.1.1, =2.0.0, =0.1.17, =1.0.0a1, =0.4.0, =0.0.1, =0.3.64, =6.1.2, =0.5.2, =1.5.0b1, =0.1.0, =0.2.23, =0.0.141, =0.1.2, =0.1.4 and more Source cves: CVE-2025-5279 Source advisory: MEND:CVE-2025-5279...

CVE-2025-5279 Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

CVE-2025-5279 Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

CVE-2025-5279

CVE-2025-5279 : The issue affects the Amazon Redshift Python Connector when configured with the BrowserAzureOAuth2CredentialsProvider plugin, where the driver skips SSL certificate validation for the Identity Provider. This can allow an attacker to intercept the token exchange and retrieve an acc...

CVE-2025-5279 Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

CVE-2025-5279: Improper Certificate Validation

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

PT-2025-23027

Name of the Vulnerable Software and Affected Versions Amazon Redshift Python Connector versions prior to 2.1.7 Description The issue arises when the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, causing the driver to skip the SSL certificate...

Amazon Redshift Python Connector security vulnerabilities

Amazon Redshift Python Connector is an Amazon Redshift Connector for Python by Amazon.com, Inc. A security vulnerability exists in the Amazon Redshift Python Connector that stems from the BrowserAzureOAuth2CredentialsProvider plugin skipping SSL certificate validation, which could lead to...

CVE-2023-28637

DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerabili...

CVE-2022-29972

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver 1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52 may allow a local user to execute arbitrary code...

django-redshift-backend (>=4.2.0, <=5.0.0), django-rest-models (>=3.0.0, <=3.0.1) +3 more potentially affected by CVE-2025-27556 via django (>=5.2.0a1, <=5.2.0rc1)

django PYPI version =5.2.0a1, =4.2.0, =3.0.0, =5.2.0a1, =5.2.0rc1 - otium-common 0.1.0 - railguns 0.103.0 Source cves: CVE-2025-27556 Source advisory: SNYK:PYTHON-DJANGO-9634162...

CVE-2024-37362: Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. CWE-522 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database...