SQL Injection in Amazon Redshift Python Connector v2.1.4
A SQL injection vulnerability in Amazon Redshift Python Connector version 2.1.4 allows users to gain escalated privileges through metadata API functions. Amazon released patch version 2.1.5 on 24 December 2024 that addresses the issue using parameterized queries.
What happened
A SQL injection vulnerability was discovered in Amazon Redshift Python Connector version 2.1.4. The vulnerability affects the metadata APIs used to retrieve information about database schemas, tables, or columns, allowing a user to gain escalated privileges via schema injection in the get_schemas, get_tables, or get_columns functions.
Reported impact
The vulnerability allows attackers to perform SQL injection through metadata API calls with a CVSS v3 base score of 8.0 (High severity). The attack requires network access and low privileges but no user interaction, with potential impacts on confidentiality, integrity, and availability.
Index analysis
Amazon released patch version 2.1.5 on 24 December 2024, which addresses the vulnerability by ensuring all metadata command inputs are sent to the Redshift server as part of parameterized queries using QUOTE_IDENT(string) or QUOTE_LITERAL(string) functions. Users affected by the vulnerability could alternatively revert to version 2.1.3.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.