Read the docs
TI-2024-11817 Aliases CVE-2024-12745GHSA-8gc2-vq6m-rwjw

SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00526 44th percentileScored 2026-11-07
Fix Fixed redshift_connector (PyPI): 2.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSAmazon Redshift Python Connector2.1.4—No fix listedCNA
—redshift_connector (PyPI)2.1.4 to before 2.1.52.1.5Patch availableGHSA-8gc2-vq6m-rwjw
  • Amazon Redshift Python Connector VendorAWS Affected 2.1.4 Fixed in — No fix listed CNA
  • redshift_connector (PyPI) Vendor— Affected 2.1.4 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-8gc2-vq6m-rwjw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amazon:redshift_connector:2.1.4:*:*:*:*:python:*:*2.1.4VulnerableAWS
  • cpe:2.3:a:amazon:redshift_connector:2.1.4:*:*:*:*:python:*:* Versions 2.1.4 Vulnerable ·AWS

Remediation

  • Fix · GHSA-8gc2-vq6m-rwjw redshift_connector (PyPI) Fixed in 2.1.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12745
  2. 2026-10-03 Alias added: GHSA-8gc2-vq6m-rwjw

References

Patch 1

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences