CVE-2024-12744

CVE-2024-12744 affects the Amazon Redshift JDBC Driver v2.1.0.31, where a SQL injection via the getSchemas, getTables, or getColumns metadata APIs can grant escalated privileges. The issue is fixed in driver v2.1.0.32; guidance is to upgrade to 2.1.0.32 or revert to 2.1.0.30. Exploitation details...

CVE-2024-12744 SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30...

CVE-2024-12746: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 Windows or Linux allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0...

CVE-2024-12745: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the getschemas, gettables, or getcolumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3...

CVE-2024-12744: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30...

Redshift ODBC Driver security vulnerabilities

Redshift ODBC Driver is an Amazon ODBC driver that is open source by Amazon Web Services. A security vulnerability exists in Redshift ODBC Driver version 2.1.5.0, which stems from an SQL injection vulnerability that could allow a user to gain escalated privileges via the SQLTables or SQLColumns...

redshift_connector security vulnerability

redshiftconnector is an Amazon Web Services open source Amazon Redshift connector for Python. A security vulnerability exists in redshiftconnector version 2.1.4 that stems from the presence of a SQL injection vulnerability that allows escalated privileges to be gained via the getschemas, gettable...

Redshift JDBC Driver security vulnerabilities

Redshift JDBC Driver is an open source Redshift JDBC driver for Amazon Web Services. A security vulnerability exists in Redshift JDBC Driver version 2.1.0.31, which stems from an SQL injection vulnerability that could allow a user to gain escalated privileges via the getSchemas, getTables, or...

PT-2024-9952

Name of the Vulnerable Software and Affected Versions: Amazon Redshift ODBC Driver version 2.1.5.0 Description: A SQL injection issue in the Amazon Redshift ODBC Driver is related to the lack of protection for the SQL query structure. This can allow a remote attacker to gain escalated privileges...

PT-2024-10193

Name of the Vulnerable Software and Affected Versions Amazon Redshift JDBC Driver version 2.1.0.31 Description A SQL injection issue in the Amazon Redshift JDBC Driver allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. This issue can be exploite...

PT-2024-10194

Name of the Vulnerable Software and Affected Versions Amazon Redshift Python Connector version 2.1.4 Description A SQL injection in the Amazon Redshift Python Connector allows a user to gain escalated privileges via the get schemas, get tables, or get columns Metadata APIs. Recommendations For...

Exploit for CVE-2024-41628

CVE-2024-41628 Simple exploit script developed by Redshift Cy...

dbt (0.16.0b2), dbt-bigquery (0.16.0b2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.16.0b2)

dbt-core PYPI version 0.16.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0b2 - dbt-bigquery 0.16.0b2 - dbt-postgres 0.16.0b2 - dbt-redshift 0.16.0b2 - dbt-snowflake 0.16.0b2 Source cves: CVE-2024-40637...

dbt (0.16.0rc2), dbt-bigquery (0.16.0rc2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.16.0rc2)

dbt-core PYPI version 0.16.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0rc2 - dbt-bigquery 0.16.0rc2 - dbt-postgres 0.16.0rc2 - dbt-redshift 0.16.0rc2 - dbt-snowflake 0.16.0rc2 Source cves: CVE-2024-406...

dbt (0.17.0rc2), dbt-bigquery (0.17.0rc2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.17.0rc2)

dbt-core PYPI version 0.17.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0rc2 - dbt-bigquery 0.17.0rc2 - dbt-postgres 0.17.0rc2 - dbt-redshift 0.17.0rc2 - dbt-snowflake 0.17.0rc2 Source cves: CVE-2024-406...

dbt (0.17.1rc3), dbt-bigquery (0.17.1rc3) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.17.1rc3)

dbt-core PYPI version 0.17.1rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.1rc3 - dbt-bigquery 0.17.1rc3 - dbt-postgres 0.17.1rc3 - dbt-redshift 0.17.1rc3 - dbt-snowflake 0.17.1rc3 Source cves: CVE-2024-406...

dbt (0.18.0b2), dbt-bigquery (0.18.0b2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.18.0b2)

dbt-core PYPI version 0.18.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.0b2 - dbt-bigquery 0.18.0b2 - dbt-postgres 0.18.0b2 - dbt-redshift 0.18.0b2 - dbt-snowflake 0.18.0b2 Source cves: CVE-2024-40637...

dbt (0.18.1b2), dbt-bigquery (0.18.1b2) +2 more potentially affected by CVE-2024-40637 via dbt-core (0.18.1b2)

dbt-core PYPI version 0.18.1b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.1b2 - dbt-bigquery 0.18.1b2 - dbt-postgres 0.18.1b2 - dbt-redshift 0.18.1b2 Source cves: CVE-2024-40637 Source advisory:...

dbt (0.19.0rc2), dbt-bigquery (0.19.0rc2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.19.0rc2)

dbt-core PYPI version 0.19.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.0rc2 - dbt-bigquery 0.19.0rc2 - dbt-postgres 0.19.0rc2 - dbt-redshift 0.19.0rc2 - dbt-sqlserver 0.19.0rc2 Source cves: CVE-2024-406...

dbt (0.19.1b2), dbt-bigquery (0.19.1b2) +4 more potentially affected by CVE-2024-40637 via dbt-core (0.19.1b2)

dbt-core PYPI version 0.19.1b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1b2 - dbt-bigquery 0.19.1b2 - dbt-postgres 0.19.1b2 - dbt-presto 0.19.1b2 - dbt-redshift 0.19.1b2 - dbt-spark 0.19.1b2 Source cves:...